CVE-2026-53760 Details
Description
Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include SameSite=Lax session cookies. An attacker crafts a malicious page that, when an authenticated administrator visits it, triggers arbitrary plugin operations. The uninstall operation executes DROP TABLE SQL scripts and destroys plugin data. This issue has been patched via commit 056b1bd.
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in Admidio, an open-source user management solution, affecting versions through 5.0.11. The issue arises in the 'modules/plugins.php' endpoint, which manages plugin installation, uninstallation, and updates. These operations are handled via GET requests without proper CSRF token validation. As a result, an attacker can create a malicious page that, when visited by an authenticated administrator, triggers unintended plugin actions. The uninstallation process is particularly destructive, as it executes SQL scripts that drop database tables and erase plugin data.
The vulnerability has been patched in Admidio version 5.1.0-Beta. Users should update to this version. The patch involves changing the plugin management operations to use POST requests instead of GET, adding CSRF token validation, and ensuring that these changes are reflected in the user interface.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Admidio/admidio/security/advisories/GHSA-hm42-q32m-vj4f | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Admidio/admidio/commit/056b1bd9f995437395e337d2c73a32e5c96ee616 | [email protected] | Source CodeVendor |
| https://github.com/Admidio/admidio/security/advisories/GHSA-hm42-q32m-vj4f | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Admidio | <= 5.1.0-Beta (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 9, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |