← Vulnerability feed

Vulnerability record · CVE-2026-34384 · published 31 March 2026

CVE-2026-34384: Admidio cross-site request forgery vulnerability

Admidio · Admidio

Admidio is an open-source user management solution. Prior to version 5.0.8, the create_user, assign_member, and assign_user action modes in modules/registration.php approve pending user registrations via GET request without validating a CSRF token. Unlike the delete_user mode in the same file (which correctly validates the token), these three approval actions read their parameters from $_GET and perform irreversible state changes without any protection. An attacker who has submitted a pending registration can extract their own user UUID from the registration confirmation email URL, then trick any user with the rol_approve_users right into visiting a crafted URL that automatically approves the registration. This bypasses the manual registration approval workflow entirely. This issue has been patched in version 5.0.8.

7.3 CVSS 3.1 High EPSS 0.19% · top 91.9% CWE-352 · Cross-site request forgery
7.3CVSS 3.1 base score
0.19%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 2 tagged exploit
24 Jul 2026Last modified by NVD

Description

Admidio is an open-source user management solution. Prior to version 5.0.8, the create_user, assign_member, and assign_user action modes in modules/registration.php approve pending user registrations via GET request without validating a CSRF token. Unlike the delete_user mode in the same file (which correctly validates the token), these three approval actions read their parameters from $_GET and perform irreversible state changes without any protection. An attacker who has submitted a pending registration can extract their own user UUID from the registration confirmation email URL, then trick any user with the rol_approve_users right into visiting a crafted URL that automatically approves the registration. This bypasses the manual registration approval workflow entirely. This issue has been patched in version 5.0.8.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/Admidio/admidio/commit/707171c188b3e8f36007fc3f2bccbfac896ed019 Patch
https://github.com/Admidio/admidio/security/advisories/GHSA-ph84-r98x-2j22 ExploitMitigationVendor Advisory
https://github.com/Admidio/admidio/security/advisories/GHSA-ph84-r98x-2j22 ExploitMitigationVendor Advisory

Track CVE-2026-34384 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2026-32817Admidio missing authorization vulnerabilityAdmidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the documents and files module does not verify whether the curre…EPSS 0.48%8.8CVE-2026-32756Admidio unrestricted file upload vulnerabilityAdmidio is an open-source user management solution. Versions 5.0.6 and below contain a critical unrestricted file upload vulnerability in the Documen…EPSS 0.95%8.8CVE-2024-37906Admidio sql injection vulnerabilityAdmidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.9, there is an SQL Inje…EPSS 0.93%8.8CVE-2024-38529Admidio unrestricted file upload vulnerabilityAdmidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.10, there is a Remote C…EPSS 1.2%8.8CVE-2021-32630Admidio unrestricted file upload vulnerabilityAdmidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.0.4, there is an authenti…EPSS 1.6%8.0CVE-2026-32813Admidio sql injection vulnerabilityAdmidio is an open-source user management solution. Versions 5.0.6 and below are vulnerable to arbitrary SQL Injection through the MyList configurati…EPSS 0.42%7.8CVE-2023-3302Admidio csv injection vulnerabilityImproper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9.EPSS 0.46%7.5CVE-2026-34381Admidio improper access control vulnerabilityAdmidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, Admidio relies on adm_my_files/.htaccess to deny dire…EPSS 0.52%

Source: NIST National Vulnerability Database (record CVE-2026-34384), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.