CVE-2026-109328 Overview
CVE-2026-109328 is an unauthenticated stored cross-site scripting (XSS) vulnerability in Admidio, an open-source membership management web application. The flaw affects Admidio versions 5.0.0 through 5.0.14 and is fixed in 5.0.15. The issue resides in RegistrationPresenter.php, which inserts the raw FIRST_NAME field submitted during registration into an unencoded data-message HTML attribute. An unauthenticated attacker registers an account using a payload that breaks out of the attribute with a double quote and injects an event handler. When an administrator hovers the malicious entry on the Manage registrations page, the injected JavaScript executes in the administrator's authenticated session [CWE-79].
Critical Impact
Attackers can execute arbitrary JavaScript in an administrator's browser session without prior authentication, enabling account takeover of Admidio administrators.
Affected Products
- Admidio 5.0.0 through 5.0.14
- RegistrationPresenter.php component
- Fixed in Admidio 5.0.15
Discovery Timeline
- 2026-10-12 - CVE-2026-109328 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-109328
Vulnerability Analysis
Admidio exposes a public self-registration workflow that allows anonymous users to create pending accounts. The RegistrationPresenter.php component builds the Manage registrations view that administrators use to approve new sign-ups. For each pending registration, the presenter emits an HTML element containing a data-message attribute whose value is derived from the submitted FIRST_NAME field.
The presenter concatenates the raw first name directly into the attribute without HTML-encoding double quotes or angle brackets. A registrant can therefore terminate the attribute early and append an inline event handler such as onmouseover. When an administrator browses the Manage registrations page and the cursor passes over the entry, the browser fires the handler and executes attacker-controlled JavaScript within the administrator session.
Because code runs with administrator privileges, an attacker can perform actions on behalf of the admin, including creating accounts, modifying roles, exfiltrating session cookies, or pivoting to further compromise of the Admidio instance.
Root Cause
The root cause is missing output encoding on user-controlled data rendered into an HTML attribute. The FIRST_NAME value is trusted and interpolated into data-message without applying context-aware escaping for attribute values. Admidio stored the payload at registration time, making this a persistent (stored) XSS rather than a reflected one.
Attack Vector
Exploitation requires network access to the public registration form and user interaction from an administrator (hovering a list entry). No credentials or prior privileges are needed on the attacker side. The payload persists in the registrations list until an administrator reviews it, at which point the stored JavaScript runs. Technical details are documented in the GitHub Security Advisory GHSA-c86v-h8qw-rxjp and the VulnCheck Advisory for Admidio XSS.
Detection Methods for CVE-2026-109328
Indicators of Compromise
- Pending or approved Admidio registrations whose FIRST_NAME field contains double quotes, angle brackets, or substrings such as onmouseover=, onerror=, onclick=, or <script.
- Outbound HTTP requests from administrator browser sessions to unfamiliar domains shortly after visiting the Manage registrations page.
- Unexpected administrative actions (role changes, new admin accounts) that correlate with recent registration reviews.
Detection Strategies
- Query the Admidio user database for first-name values containing HTML metacharacters or JavaScript event-handler keywords.
- Inspect web server access logs for POST requests to the registration endpoint with payload bodies containing encoded quote characters (%22) alongside on-prefixed handler names.
- Review HTML responses from the Manage registrations page for data-message attributes containing content that escapes the quoted attribute context.
Monitoring Recommendations
- Enable Content Security Policy (CSP) violation reporting to catch inline script execution attempts in administrator sessions.
- Alert on administrator account creation, role elevation, or password resets performed from unusual IP addresses or outside business hours.
- Monitor the Admidio application and web server logs for abnormal traffic patterns following registration submissions.
How to Mitigate CVE-2026-109328
Immediate Actions Required
- Upgrade all Admidio instances to version 5.0.15 or later without delay.
- Audit the user and registration tables for existing payloads containing quotes, angle brackets, or event-handler keywords and remove or sanitize them before any administrator opens the Manage registrations page.
- Rotate administrator credentials and invalidate active sessions if evidence of exploitation is found.
Patch Information
The maintainers fixed the issue in Admidio 5.0.15 by properly encoding user-supplied values before inserting them into HTML attributes. Full details are available in the GitHub Security Advisory GHSA-c86v-h8qw-rxjp.
Workarounds
- Disable public self-registration until the upgrade is complete, or restrict access to the registration form via network controls.
- Deploy a web application firewall rule that blocks registration submissions whose FIRST_NAME field contains double quotes, angle brackets, or on\w+= event-handler patterns.
- Apply a strict Content Security Policy on the administrative interface to prevent inline script execution and limit the impact of residual XSS payloads.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
