CSRF Vulnerability in Admidio User Management Solution Affecting Role Management

CVE-2026-32816

What is CVE-2026-32816?

The Admidio user management solution has a CSRF vulnerability in versions 5.0.0 through 5.0.6, affecting the management of organizational roles. The absence of proper validation for CSRF tokens in critical state-changing operations allows attackers to exploit the system by embedding forged POST forms. Users with rights to assign roles can be tricked into carrying out harmful actions, such as permanent deletion of roles, which cascades beyond just the role itself, impacting all memberships, rights data, and access to various organizational resources. The vulnerability can be exploited through devices that can access a publicly visible role UUID, leading to significant security breaches without any straightforward recovery option besides database restoration. This issue has been resolved in version 5.0.7.

References