CVE-2026-101093

Published 28 September 2026 · tracked since 29 September 2026

Description

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associated p

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-102264 LOW 3.5
• CVE-2026-102263 MEDIUM 4.7
• CVE-2026-102414 LOW 3.7
• CVE-2026-102422 HIGH 8.1
• CVE-2026-102247 MEDIUM 6.8
• CVE-2026-96326 HIGH 7.2
• CVE-2026-101858 MEDIUM 4.7
• CVE-2026-101859 MEDIUM 5.4
• CVE-2026-101860 HIGH 8.8
• CVE-2026-101280 HIGH 7.3

→ Open the live CVE board · all tools