Read the docs
TI-2026-38767 Aliases CVE-2026-53760GHSA-hm42-q32m-vj4f

Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests

Priority MEDIUM 57CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include SameSite=Lax session cookies. An attacker crafts a malicious page that, when an authenticated administrator visits it, triggers arbitrary plugin operations. The uninstall operation executes DROP TABLE SQL scripts and destroys plugin data. This issue has been patched via commit 056b1bd.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00167 6th percentileScored 2026-11-07
Fix Fixed admidio (Admidio): 056b1bd9f995437395e337d2c73a32e5c96ee616

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Admidioadmidiobefore 056b1bd9f995437395e337d2c73a32e5c96ee616056b1bd9f995437395e337d2c73a32e5c96ee616Patch availableCNA
—admidio/admidio (Packagist)up to 5.0.11—No fix listedGHSA-hm42-q32m-vj4f
  • admidio VendorAdmidio Affected before 056b1bd9f995437395e337d2c73a32e5c96ee616 Fixed in 056b1bd9f995437395e337d2c73a32e5c96ee616 Patch available CNA
  • admidio/admidio (Packagist) Vendor— Affected up to 5.0.11 Fixed in — No fix listed GHSA-hm42-q32m-vj4f

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*——Admidio
  • cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:* Versions — — ·Admidio

Remediation

  • Fix · CNA admidio (Admidio) Fixed in 056b1bd9f995437395e337d2c73a32e5c96ee616

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53760
  2. 2026-10-03 Alias added: GHSA-hm42-q32m-vj4f

References

Other 3

  • TI-2026-25286 Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion CVSS 3.1CRITICAL 9.1
  • TI-2026-56995 Admidio before 5.0.12 Authentication Bypass via RSS feeds CVSS 4.0HIGH 8.7
  • TI-2026-56993 Admidio before 5.0.12 SQL Injection via relation_type_list CVSS 4.0HIGH 8.7
  • TI-2024-25222 Admidio has Blind SQL Injection in ecard_send.php CVSS 3.1CRITICAL 10.0
  • TI-2026-30186 Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed CVSS 3.1HIGH 8.2
  • TI-2024-25764 Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment CVSS 3.1CRITICAL 9.1
See all 72 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences