Cross-Site Request Forgery Vulnerability in Admidio User Management Solution

CVE-2026-53760

What is CVE-2026-53760?

A vulnerability exists in the Admidio user management solution that allows an attacker to exploit CSRF by sending crafted GET requests to the modules/plugins.php endpoint. This endpoint manages various plugin operations without sufficient CSRF token validation, which means that when an authenticated administrator visits a malicious page, they may unknowingly trigger arbitrary plugin actions. Such actions can include the uninstallation of plugins, potentially leading to data loss through the execution of DROP TABLE SQL commands. The issue has been addressed in subsequent updates with a patch.

References