What is the CVSS score of CVE-2026-34384?

CVE-2026-34384 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34384?

Yes, a patch is available for CVE-2026-34384. Update the affected software to the latest version immediately.

PHP CVE-2026-34384

EUVD-2026-17628 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-31 GitHub_M

GHSA-ph84-r98x-2j22

PHP CSRF Admidio

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Jul 24, 2026 - 20:22 vuln.today

cvss_changed

Severity Changed

Jul 24, 2026 - 20:22 NVD

MEDIUM HIGH

CVSS changed

Jul 24, 2026 - 20:22 NVD

4.5 (MEDIUM) 7.3 (HIGH)

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 21:14 euvd

EUVD-2026-17628

Analysis Generated

Mar 31, 2026 - 21:14 vuln.today

CVE Published

Mar 31, 2026 - 20:34 nvd

MEDIUM 4.5

DescriptionNVD

Admidio is an open-source user management solution. Prior to version 5.0.8, the create_user, assign_member, and assign_user action modes in modules/registration.php approve pending user registrations via GET request without validating a CSRF token. Unlike the delete_user mode in the same file (which correctly validates the token), these three approval actions read their parameters from $_GET and perform irreversible state changes without any protection. An attacker who has submitted a pending registration can extract their own user UUID from the registration confirmation email URL, then trick any user with the rol_approve_users right into visiting a crafted URL that automatically approves the registration. This bypasses the manual registration approval workflow entirely. This issue has been patched in version 5.0.8.

AnalysisAI

Admidio prior to version 5.0.8 allows attackers with pending registration status to bypass CSRF protections and trick administrators with approval rights into automatically approving registrations via malicious URLs, enabling unauthorized account activation without manual review. The vulnerability affects the create_user, assign_member, and assign_user action modes in modules/registration.php, which process GET requests without token validation unlike the delete_user mode in the same file. An attacker extracts their user UUID from a registration confirmation email, crafts a URL targeting administrators, and gains illicit account approval through social engineering rather than technical compromise.

Technical ContextAI

Admidio's registration approval workflow relies on role-based access control (rol_approve_users) to gate administrative actions. The vulnerability stems from a classic CSRF flaw (CWE-352) where state-modifying operations read directly from the $_GET superglobal without synchronization tokens or same-site cookie validation. The affected code path processes registration approvals (create_user, assign_member, assign_user modes) without the CSRF protection implemented in the delete_user mode within the same file, indicating inconsistent security controls. Attackers leverage the fact that registration confirmation emails contain user UUIDs in plaintext URLs, making those identifiers discoverable to the attacker themselves. The root cause is the absence of anti-CSRF mechanisms (such as CSRF tokens or SameSite attributes) on state-changing operations accessible via GET requests.

RemediationAI

Vendor-released patch: Admidio version 5.0.8 or later. Administrators must upgrade immediately via the official Admidio release channel (GitHub: https://github.com/Admidio/admidio/security/advisories/GHSA-ph84-r98x-2j22). The patched version implements CSRF token validation on the create_user, assign_member, and assign_user action modes in modules/registration.php, aligning them with the pre-existing protection in delete_user. As a temporary mitigation prior to patching, organizations can reduce exposure by restricting administrative access to the registration approval interface to a limited set of users and disabling self-registration if it is not operationally necessary. Additionally, administrators should be trained to avoid clicking links in emails or external sources that reference registration approval actions.