Cross-Site Request Forgery Vulnerability in Admidio User Management Solution

CVE-2026-47232

What is CVE-2026-47232?

Admidio, an open-source user management solution, has a vulnerability in its sensitive export functionality before version 5.0.10. The mode=export action in modules/sso/keys.php allows for the export of a PKCS#12 bundle containing critical private key and certificate information without proper CSRF validation. As the validation line is commented out, an attacker could exploit this flaw through a forged cross-site POST request from an administrator session, leading to unauthorized access to sensitive credentials. It is crucial for users of affected versions to upgrade to 5.0.10 or later to mitigate this security risk.

References