CVE-2026-47228

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.10

Description Admidio contains a Cross-Site Request Forgery (CSRF) flaw in the modules/registration.php endpoint. When the mode parameter is set to send login, the application fails to validate the adm csrf token and does not enforce the HTTP POST method. This allows an attacker to coerce a logged-in registration administrator into resetting the password of any user, including the administrator themselves, by inducing them to visit a malicious page. The system regenerates a random password for the user specified by the user uuid assigned variable, updates the bcrypt hash in the adm users.usr password field, and emails the cleartext password to the victim. This can lead to account lockout, denial of service for the affected user, and potential social engineering attacks.

Recommendations Update Admidio to version 5.0.10. As a temporary workaround, restrict access to the modules/registration.php endpoint to trusted networks or ensure administrators do not visit untrusted external sites while authenticated.