What is the CVSS score of CVE-2026-32816?

CVE-2026-32816 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-32816?

Organizations using versions 5.0.0 should be aware of moderate risk from CVE-2026-32816, a cross-site request forgery vulnerability rated CVSS 5.7.. A patch is available.

How to fix or mitigate CVE-2026-32816?

Within 30 days: Identify affected systems running versions 5.0.0 and apply vendor patches as part of regular patch cycle. Verify anti-CSRF tokens are enforced.

PHP CVE-2026-32816

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-19 security-advisories@github.com

GHSA-wwg8-6ffr-h4q2

PHP CSRF

5.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.7 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 19, 2026 - 23:30 vuln.today

CVE Published

Mar 19, 2026 - 23:16 nvd

MEDIUM 5.7

DescriptionGitHub Advisory

Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the delete, activate, and deactivate modes in modules/groups-roles/groups_roles.php perform destructive state changes on organizational roles but never validate an anti-CSRF token. The client-side UI passes a CSRF token to callUrlHideElement(), which includes it in the POST body, but the server-side handlers ignore $_POST["adm_csrf_token"] entirely for these three modes. An attacker who can discover a role UUID (visible in the public cards view when the module is publicly accessible) can embed a forged POST form on any external page and trick any user with the rol_assign_roles right into deleting or toggling roles for the organization. Role deletion is permanent and cascades to all memberships, event associations, and rights data. If exploited, an attacker can trick any user with delegated role-assignment rights into permanently deleting roles, mass-revoking all associated memberships and access to events, documents, and mailing lists, or silently activating or deactivating entire groups, with target role UUIDs trivially harvested from the unauthenticated public cards view and no undo path short of a database restore. This issue has been fixed in version 5.0.7.

AnalysisAI

Admidio versions 5.0.0 through 5.0.6 contain a critical cross-site request forgery (CSRF) vulnerability in the groups-roles management module that allows unauthenticated attackers to trick privileged users into permanently deleting organizational roles, deactivating groups, or revoking memberships through forged POST requests. The vulnerability affects users with rol_assign_roles privileges, and exploited attacks result in permanent data loss including cascading deletion of role memberships, event associations, and access rights with no built-in undo mechanism. A patch is available in version 5.0.7, and the vulnerability is not currently tracked in active exploitation databases but poses significant organizational impact due to the permanent nature of role deletion and the low barrier to discovery of target role UUIDs from publicly accessible card views.

Technical ContextAI

Admidio is an open-source PHP-based user management and organization administration system. The vulnerability exists in modules/groups-roles/groups_roles.php, which implements role lifecycle operations (delete, activate, deactivate modes) without server-side validation of anti-CSRF tokens despite the client-side UI correctly passing CSRF tokens via the adm_csrf_token POST parameter. This is a classic CWE-352 Cross-Site Request Forgery vulnerability where the application performs state-changing operations on POST requests without verifying that the request originated from an authenticated user's browser session. The root cause is asymmetric CSRF protection: the client-side callUrlHideElement() function includes the CSRF token in the POST body, but the server-side handlers ignore $_POST['adm_csrf_token'] entirely, creating a false sense of security. Role UUIDs are trivially enumerable from unauthenticated public card views when the module is configured as publicly accessible, eliminating the need for an attacker to perform reconnaissance.

RemediationAI

Immediately upgrade Admidio to version 5.0.7 or later, which includes server-side CSRF token validation for all role lifecycle operations (delete, activate, deactivate). The upgrade can be performed through standard package management or manual extraction from https://github.com/Admidio/admidio/releases/tag/v5.0.7. For organizations unable to patch immediately, temporary mitigations include disabling public access to the groups-roles module via access control lists, restricting the rol_assign_roles permission to only trusted administrative accounts, and implementing network-level CSRF protections such as SameSite cookie enforcement (if the application supports modern session cookie attributes) and HTTP referrer validation at the reverse proxy or WAF layer. However, these mitigations do not address the underlying vulnerability and should be considered temporary measures only; patching remains the only complete remediation.