CVE-2026-55742 -- CVSS 9.6 Vulnerability Briefing

CVE-2026-55742 | CVSS 9.6 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-55742 is a Cross-Site Request Forgery (CSRF) vulnerability in the administration rights handler of Cotonti version 1.0.0 (master branch, commit f43f1fc3), specifically affecting the file system/admin/admin.rights.php.

Technical Detail

The flaw exists because the rights update action ('a=update') in admin.rights.php does not enforce CSRF token validation, allowing an attacker to craft a malicious request that, when executed by an authenticated administrator's browser, modifies user or group permissions without the administrator's knowledge or consent. An attacker would need to socially engineer a logged-in administrator into visiting a crafted page or clicking a malicious link to trigger the forged request. Successful exploitation could result in unauthorized privilege escalation, granting attacker-controlled accounts elevated administrative rights within the Cotonti application.

Exploitation Status

No known exploit code has been publicly identified for this vulnerability at this time. This CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. The exploit maturity is currently assessed as none, meaning no proof-of-concept or operational exploit has been confirmed in public repositories or threat intelligence sources as of June 25, 2026.

Who Is Targeting This

No specific threat actor attribution at this time. The reported_threat_actors field contains no public attribution, and no confirmed actor has been linked to exploitation of this vulnerability. No campaigns or targeted sectors have been identified in connection with this CVE.

What To Do

Administrators running Cotonti 1.0.0 on the master branch should monitor the official Cotonti repository for a patched release and apply it as soon as one becomes available. In the interim, restrict access to the administration panel by enforcing IP allowlisting or placing the admin interface behind a VPN or authenticated reverse proxy to reduce the attack surface. Administrators should exercise caution when browsing the web or clicking external links while authenticated to the Cotonti admin panel. Detection can be aided by reviewing web server logs for unexpected POST requests to admin.rights.php with the 'a=update' parameter originating from unusual referrers or external sources. No CISA binding directive applies to this CVE at this time.