CVE-2026-41663: Admidio CSRF Vulnerability

CVE-2026-41663 Overview

CVE-2026-41663 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in Admidio, an open-source user management platform. Versions prior to 5.0.9 expose several administrative operations in the preferences module, including database backup, test email, and htaccess generation. These operations execute through HTTP GET requests without CSRF token validation. Because SameSite=Lax cookies accompany top-level GET navigations, an attacker can lure an authenticated administrator to a malicious page that triggers these actions. The maintainers patched the issue in version 5.0.9.

Critical Impact
An authenticated administrator visiting an attacker-controlled page can be coerced into executing privileged preference operations without their consent.

Affected Products

Admidio versions prior to 5.0.9
Admidio preferences module (database backup, test email, htaccess generation handlers)
Self-hosted Admidio deployments using default cookie configuration

Discovery Timeline

2026-05-07 - CVE-2026-41663 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-41663

Vulnerability Analysis

The vulnerability exists in Admidio's preferences module. Multiple administrative endpoints accept GET requests and execute state-changing operations without verifying a CSRF token. The affected actions include initiating a database backup, sending a test email, and generating .htaccess configuration files.

Browsers send SameSite=Lax cookies along with top-level GET navigations. An attacker can craft a page that triggers a navigation, image load, or redirect to the vulnerable endpoint. If an Admidio administrator is authenticated in the same browser, the request executes under their session.

Root Cause

The root cause is missing anti-CSRF defenses on state-changing handlers. Two design issues compound the problem. First, sensitive actions are exposed via GET rather than POST. Second, no synchronizer token, double-submit cookie, or origin check validates request authenticity. The SameSite=Lax default does not block top-level GET requests, so it provides no mitigation here.

Attack Vector

Exploitation requires an authenticated Admidio administrator and user interaction such as clicking a link or visiting an attacker-controlled page. The attacker hosts content that issues a GET request to a vulnerable preferences endpoint, for example through an <img> tag, an <iframe>, or a window navigation. The administrator's browser attaches the session cookie, and the server processes the request as legitimate.

The vulnerability mechanism is described in the GitHub Security Advisory GHSA-rw74-vc9h-534j. No verified proof-of-concept code is published in the NVD record.

Detection Methods for CVE-2026-41663

Indicators of Compromise

Unexpected database backup files generated outside scheduled maintenance windows
Test email events in mail server logs originating from the Admidio host without administrator action
Modifications to .htaccess files in the Admidio web root that do not match administrative change tickets
HTTP access logs showing GET requests to preferences module endpoints with Referer headers from external or unrecognized domains

Detection Strategies

Review web server access logs for GET requests to administrative preferences URLs accompanied by cross-origin Referer values.
Correlate authenticated admin session activity with off-hours or unsolicited preference changes.
Alert on file system changes to backup directories and .htaccess files in the Admidio installation path.

Monitoring Recommendations

Enable verbose application logging in Admidio to capture the source IP, user agent, and Referer for every preferences action.
Forward web server and application logs to a centralized SIEM and create rules for cross-origin requests against administrative routes.
Monitor outbound mail flow from the Admidio server for unexpected test messages.

How to Mitigate CVE-2026-41663

Immediate Actions Required

Upgrade Admidio to version 5.0.9 or later, which contains the official fix.
Instruct administrators to log out of Admidio sessions before browsing untrusted sites until patching is complete.
Restrict access to the Admidio administrative interface by source IP or VPN where feasible.

Patch Information

The issue is resolved in Admidio 5.0.9. Release artifacts and notes are available at the Admidio v5.0.9 release page. Administrators should review the upgrade procedure in the project documentation and validate the deployment after upgrade.

Workarounds

Place the Admidio administrative paths behind an authenticating reverse proxy that enforces strict Referer or Origin header checks.
Configure session cookies with SameSite=Strict if the application and its workflows tolerate the change, reducing cross-site request feasibility.
Require administrators to use a dedicated browser profile for Admidio management to limit exposure to malicious pages.

bash

# Example nginx snippet enforcing Origin check on Admidio admin paths
location /adm_program/modules/preferences/ {
    if ($http_origin !~* ^https?://admidio\.example\.com$) {
        return 403;
    }
    proxy_pass http://admidio_backend;
}