Is CVE-2026-55742 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55742 being exploited in the wild.

How severe is CVE-2026-55742?

Critical severity, with a CVSS score of 9.6, published 18 June 2026.

Which products and versions are affected?

Cotonti <= 1.0.0, 1.0.0 (commit f43f1fc3); cotonti/cotonti (Packagist) <= 1.0.0, ECOSYSTEM:introduced=0,last_affected=1.0.0.

Is there a fix for CVE-2026-55742?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-55742 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55742?

Check whether you run Cotonti or cotonti/cotonti (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55742: Cotonti CSRF in administration rights handler

Q: Which products and versions are affected?

Cotonti <= 1.0.0, 1.0.0 (commit f43f1fc3); cotonti/cotonti (Packagist) <= 1.0.0, ECOSYSTEM:introduced=0,last_affected=1.0.0.

Q: Is there a fix for CVE-2026-55742?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-55742 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-55742?

Check whether you run Cotonti or cotonti/cotonti (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55742 · Severity: critical · CVSS 9.6 · Published 2026-06-18

Cotonti is a content management system used to build and manage websites. A security flaw in its administration panel allows an attacker to trick a logged-in administrator into unknowingly performing actions, such as granting the attacker full administrative rights. This could lead to a complete takeover of the website, theft of sensitive data, or the execution of malicious code on the server.

Technologies: Cotonti, cotonti/cotonti (Packagist). Vendors: Cotonti, Packagist.

Quick answers

Is CVE-2026-55742 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55742 being exploited in the wild.
How severe is CVE-2026-55742?: Critical severity, with a CVSS score of 9.6, published 18 June 2026.
Which products and versions are affected?: Cotonti <= 1.0.0, 1.0.0 (commit f43f1fc3); cotonti/cotonti (Packagist) <= 1.0.0, ECOSYSTEM:introduced=0,last_affected=1.0.0.
Is there a fix for CVE-2026-55742?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-55742 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55742?: Check whether you run Cotonti or cotonti/cotonti (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in Cotonti 1.0.0 (specifically commit f43f1fc3) within the 'system/admin/admin.rights.php' component. The rights update action ('a=update') fails to implement anti-CSRF token validation via the 'cot_check_xg()' function. By luring an authenticated administrator to a malicious website, a remote attacker can trigger a forged request to modify group access rights. Successful exploitation allows the attacker to elevate a controlled account to administrator status. Given that administrators can modify site templates and configurations, this vulnerability can be further leveraged to achieve Remote Code Execution (RCE).

Affected products

Cotonti Cotonti 1.0.0 (commit f43f1fc3)

Identifiers

CVE-2026-55742
GHSA-7g3p-35vc-mgjr

Timeline

2026-06-18: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.