Is CVE-2026-101093 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-101093?

CVE-2026-101093 has a CVSS v3 severity of MEDIUM (5.4).

Back

CVE-2026-101093

Description

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associated permissions by riding the administrator's session.