User Management Solution Vulnerability in Admidio

CVE-2026-47228

What is CVE-2026-47228?

An issue in Admidio, an open-source user management solution, allows an attacker to exploit the send_login method in the modules/registration.php file. Unlike other state-altering functions, this method does not validate CSRF tokens, leading to potential unauthorized password resets. Specifically, a registration-administrator can inadvertently trigger a password regeneration request without proper authentication, as the server may use the admin's cookies to reset a chosen user's password without interactive confirmation. The vulnerability is resolved in version 5.0.10, which implements necessary CSRF validation.

References