Cross-Site Request Forgery Vulnerability in Admidio User Management Solution

CVE-2026-32755

What is CVE-2026-32755?

The Admidio user management solution contains a Cross-Site Request Forgery vulnerability in the save_membership action of profile_function.php. This weakness allows an attacker to manipulate membership dates for users without authorization. Specifically, if a role leader is tricked into submitting a crafted POST request, their session can be exploited to change membership status, potentially leading to unauthorized access or revocation of privileges. This issue arises due to the absence of CSRF token validation in the save_membership action, although it is checked for other actions like stop_membership and remove_former_membership. It is crucial to update to version 5.0.7 or later to mitigate this risk.

References