EUVD-2026-52286
GHSA-xp3j-j2g9-8cmv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CSRF mandates victim interaction (UI:R); attacker holds no system privileges (PR:N); impact is limited to category config deletion or duplication with no confidentiality path.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters (delete and copy). An attacker can trick an authenticated administrator into visiting a crafted URL to delete or duplicate Category Report configurations, affecting the integrity and availability of that module's configuration.
AnalysisAI
Cross-site request forgery in Admidio's Category Report preferences module (all versions before 5.0.11) enables an unauthenticated attacker to silently delete or duplicate Category Report configurations by tricking an authenticated administrator into visiting a crafted URL. The endpoint modules/category-report/preferences.php processes state-changing delete and copy operations via HTTP GET parameters without validating the adm_csrf_token, meaning any browser request carrying a valid admin session cookie will be executed regardless of origin. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; risk is constrained by the social engineering prerequisite.
Technical ContextAI
Admidio is an open-source PHP community management platform. The vulnerable component is modules/category-report/preferences.php, which administers the Category Report module's configuration. CWE-352 (Cross-Site Request Forgery) manifests here because the endpoint triggers persistent state changes - delete and copy - through GET parameters without verifying the adm_csrf_token that Admidio should issue to authenticated sessions. Browsers automatically attach session cookies to any cross-origin GET request, so an attacker-controlled page or email link can silently invoke the endpoint under the victim's session context. The CPE cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:* covers all Admidio releases; EUVD-2026-52286 and the vendor advisory GHSA-mvx3-m6p6-7r9w bound the vulnerable range to versions 0 through pre-5.0.11.
RemediationAI
Upgrade Admidio to version 5.0.11 or later, which incorporates the fix from commit e1fe6fd2fcafb6a65a550760f79447abdef31461 (https://github.com/Admidio/admidio/commit/e1fe6fd2fcafb6a65a550760f79447abdef31461); the vendor security advisory is at https://github.com/Admidio/admidio/security/advisories/GHSA-mvx3-m6p6-7r9w. As a compensating control prior to patching, restrict network-level access to the Category Report preferences endpoint (modules/category-report/preferences.php) to trusted administrator IP ranges at the web server or reverse proxy - this reduces CSRF delivery surface but does not eliminate the underlying flaw. Enforcing a SameSite=Strict or SameSite=Lax cookie attribute on the Admidio session cookie at the server level would also block cross-site forged requests, though this requires application-layer configuration access.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today