Cross-site Request Forgery (CSRF) Affecting admidio/admidio package, versions <5.0.10
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Cross-site Request Forgery (CSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PHP-ADMIDIOADMIDIO-17112479
- published31 May 2026
- disclosed29 May 2026
- credit0x2face
Introduced: 29 May 2026
NewCVE-2026-47232 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade admidio/admidio to version 5.0.10 or higher.
Overview
admidio/admidio is a free open source user management system for websites of organizations and groups.
Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via the export process in modules/sso/keys.php when CSRF validation is not enforced. An attacker can trigger the export of sensitive PKCS#12 private key material by enticing an authenticated administrator to visit a malicious site that issues a forged POST request.