CVE-2026-34384

Katalog CVE

CVSS 7.3 · High EPSS 0,19%

Kerentanan Cross-Site Request Forgery (CSRF) pada admidio. Skor CVSS 3.1 7.3 (High) menurut NVD.

Deskripsi (NVD)

Admidio is an open-source user management solution. Prior to version 5.0.8, the create_user, assign_member, and assign_user action modes in modules/registration.php approve pending user registrations via GET request without validating a CSRF token. Unlike the delete_user mode in the same file (which correctly validates the token), these three approval actions read their parameters from $_GET and perform irreversible state changes without any protection. An attacker who has submitted a pending registration can extract their own user UUID from the registration confirmation email URL, then trick any user with the rol_approve_users right into visiting a crafted URL that automatically approves the registration. This bypasses the manual registration approval workflow entirely. This issue has been patched in version 5.0.8.

Rincian

Terbit di NVD

31 Maret 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.3 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 8,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Admidio/admidio/security/advisories/GHSA-ph84-r98x-2j22 exploit · mitigasi · advisory vendor
• https://github.com/Admidio/admidio/commit/707171c188b3e8f36007fc3f2bccbfac896ed019 patch