CVE-2026-34384
MediumCVSS 4.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Admidio prior to version 5.0.8 contains a CSRF vulnerability in the registration module. Approval actions for pending registrations (create_user, assign_member, assign_user) are performed via GET requests without CSRF token validation, allowing an attacker to auto-approve their own registration by tricking an administrator with appropriate rights.
Risk Assessment
An attacker can bypass the manual registration approval process and gain unauthorized access to the system, potentially leading to privilege escalation or data breach.
Recommendation
Update Admidio to version 5.0.8 or later which includes the fix. In the meantime, restrict the rol_approve_users permission to trusted administrators only.
Original NVD description (English source)
Admidio is an open-source user management solution. Prior to version 5.0.8, the create_user, assign_member, and assign_user action modes in modules/registration.php approve pending user registrations via GET request without validating a CSRF token. Unlike the delete_user mode in the same file (which correctly validates the token), these three approval actions read their parameters from $_GET and perform irreversible state changes without any protection. An attacker who has submitted a pending registration can extract their own user UUID from the registration confirmation email URL, then trick any user with the rol_approve_users right into visiting a crafted URL that automatically approves the registration. This bypasses the manual registration approval workflow entirely. This issue has been patched in version 5.0.8.