CSRF Vulnerability in Admidio Open-Source User Management Tool

CVE-2026-34382

What is CVE-2026-34382?

Admidio, an open-source user management solution, contains a Cross-Site Request Forgery (CSRF) vulnerability that affects versions from 5.0.0 up to, but not including, 5.0.8. This issue arises from a flaw in the delete mode handler located in mylist_function.php, where the system fails to validate CSRF tokens. An attacker could exploit this vulnerability by tricking an authenticated user into visiting a malicious page, resulting in the unauthorized permanent deletion of list configurations, including organization-wide shared lists, especially if the targeted user has administrator privileges. Users are advised to upgrade to version 5.0.8 to mitigate this risk.

References