What is the CVSS score of CVE-2026-34382?

CVE-2026-34382 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34382?

Yes, a patch is available for CVE-2026-34382. Update the affected software to the latest version immediately.

PHP CVE-2026-34382

EUVD-2026-17624 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-31 GitHub_M

GHSA-g3mx-8jm6-rc85

PHP CSRF

4.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.6 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 21:14 euvd

EUVD-2026-17624

Analysis Generated

Mar 31, 2026 - 21:14 vuln.today

CVE Published

Mar 31, 2026 - 20:32 nvd

MEDIUM 4.6

DescriptionGitHub Advisory

Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, the delete mode handler in mylist_function.php permanently deletes list configurations without validating a CSRF token. An attacker who can lure an authenticated user to a malicious page can silently destroy that user's list configurations - including organization-wide shared lists when the victim holds administrator rights. This issue has been patched in version 5.0.8.

AnalysisAI

Admidio 5.0.0 through 5.0.7 allows authenticated users to permanently delete list configurations via CSRF attacks in the mylist_function.php delete handler, lacking CSRF token validation. An attacker can craft a malicious page to silently destroy a victim's shared list configurations, including organization-wide lists if the victim holds administrator rights. No public exploit code has been identified at time of analysis. Vendor-released patch: version 5.0.8.

Technical ContextAI

The vulnerability exists in Admidio's mylist_function.php file, which handles deletion operations for user-configurable lists without proper CSRF token validation. The root cause is classified as CWE-352 (Cross-Site Request Forgery), a common PHP web application weakness where state-changing operations fail to verify an anti-CSRF token before processing the request. Admidio is an open-source user and organization management system written in PHP. The affected versions (5.0.0 to 5.0.7) lack the necessary token validation mechanism that would ensure delete requests originate from the legitimate user's session and not from an attacker-controlled third-party context. This allows an authenticated user's browser session to be abused without their knowledge when they visit a malicious page.

RemediationAI

Vendor-released patch: Admidio version 5.0.8. Administrators should upgrade all Admidio installations to version 5.0.8 or later. The fix is confirmed by upstream commit 317ec91ad3baf19d4179db6c32413812eb36d7ca, which adds proper CSRF token validation to the delete mode handler in mylist_function.php. No workarounds are available for versions prior to 5.0.8; patching is the only remediation. Refer to the GitHub Security Advisory at https://github.com/Admidio/admidio/security/advisories/GHSA-g3mx-8jm6-rc85 for official guidance and the patched release download.