What is the CVSS score of CVE-2026-34383?

CVE-2026-34383 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34383?

Yes, a patch is available for CVE-2026-34383. Update the affected software to the latest version immediately.

Admidio CVE-2026-34383

EUVD-2026-17626 MEDIUM

Improper Input Validation (CWE-20)

2026-03-31 GitHub_M

GHSA-4rwm-c5mj-wh7x

CSRF Admidio

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 21:14 euvd

EUVD-2026-17626

Analysis Generated

Mar 31, 2026 - 21:14 vuln.today

CVE Published

Mar 31, 2026 - 20:33 nvd

MEDIUM 4.3

DescriptionGitHub Advisory

Admidio is an open-source user management solution. Prior to version 5.0.8, the inventory module's item_save endpoint accepts a user-controllable POST parameter imported that, when set to true, completely bypasses both CSRF token validation and server-side form validation. An authenticated user can craft a direct POST request to save arbitrary inventory item data without CSRF protection and without the field value checks that the FormPresenter validation normally enforces. This issue has been patched in version 5.0.8.

AnalysisAI

Admidio versions prior to 5.0.8 allow authenticated users to bypass CSRF token validation and server-side form validation in the inventory module's item_save endpoint by setting the imported POST parameter to true, enabling unauthorized modification of inventory item data without proper security checks. The vulnerability requires valid authentication but carries moderate impact due to the complete circumvention of two independent security controls.

Technical ContextAI

Admidio is an open-source user management and administrative system. The vulnerability exists in the inventory module's item_save endpoint, which implements form validation through a FormPresenter class that normally enforces field-level validation and CSRF token verification. The vulnerable code path recognizes a user-controllable imported parameter; when set to true, this parameter causes the endpoint to skip both CSRF token validation logic and the FormPresenter's value-checking mechanisms. This represents an improper input validation issue (CWE-20) where insufficient server-side checks on a control parameter allow attackers to bypass authentication and integrity controls that should apply uniformly to all requests. The vulnerability affects the Admidio application across versions before 5.0.8 (CPE: cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*).

RemediationAI

Vendor-released patch: Admidio 5.0.8. Administrators must upgrade to version 5.0.8 or later to remediate the vulnerability. The patch is confirmed via the GitHub commit 00494b95dfe847af8b938e4397e5d909d8f36839, which directly addresses the bypass by restoring proper CSRF token and form validation enforcement regardless of the imported parameter value. No interim workarounds that preserve full functionality are documented; therefore, upgrading to the patched version is the only supported remediation. See the GitHub security advisory at https://github.com/Admidio/admidio/security/advisories/GHSA-4rwm-c5mj-wh7x for detailed upgrade instructions and validation steps.