CVE-2026-47232

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.10

Description An issue exists where the mode=export action in the modules/sso/keys.php endpoint exports a PKCS#12 bundle containing the configured private key and certificate without proper Cross-Site Request Forgery (CSRF) validation. Because the validation line is commented out, a forged cross-site POST request from an authenticated administrator session can trigger the export of the private key without a valid form token. The process involves the exportToPkcs12() function, which accepts a key UUID and an export password to return the private key material and certificate as a browser download.

Recommendations Update to version 5.0.10. As a temporary mitigation, restrict access to the modules/sso/keys.php endpoint to minimize the risk of unauthorized private key export.