CVE-2026-47228: Admidio CSRF Vulnerability

CVE-2026-47228 Overview

CVE-2026-47228 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in Admidio, an open-source user management solution. The flaw exists in modules/registration.php within the send_login mode. This mode regenerates a random password for a target user, stores the bcrypt hash in adm_users.usr_password, and emails the cleartext credentials to that user. Unlike sibling modes in the same file, send_login does not call SecurityUtils::validateCsrfToken() on the incoming request. Versions prior to 5.0.10 are affected. Version 5.0.10 remediates the issue.

Critical Impact
An attacker who lures a registration-administrator to a malicious page can trigger a top-level navigation that resets any chosen user's password without administrator interaction.

Affected Products

Admidio versions prior to 5.0.10

Discovery Timeline

2026-08-12 - CVE-2026-47228 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-47228

Vulnerability Analysis

The vulnerability resides in the registration module of Admidio. State-changing modes in modules/registration.php such as assign_member, assign_user, delete_user, and create_user invoke SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']) before performing sensitive operations. The send_login branch omits this check.

When send_login executes, the server generates a new random password for user_uuid_assigned, writes its bcrypt hash to the user record, and dispatches the cleartext value to the user's email. Because no CSRF token is validated, any authenticated administrator session can be coerced into issuing this request. The attacker never sees the new password directly, but the account holder receives credentials that the attacker has induced the system to issue, disrupting account integrity and availability for the targeted user.

Root Cause

The root cause is a missing CSRF token validation in the send_login request handler. The application relies on SameSite=Lax cookies as an implicit boundary. Lax cookies are still transmitted on top-level navigations, so a crafted link or auto-submitting form is sufficient to carry the administrator's session to the vulnerable endpoint.

Attack Vector

An attacker crafts a page containing a top-level navigation to the vulnerable send_login endpoint with a chosen user_uuid_assigned parameter. The attacker lures a registration-administrator to visit the page. The browser attaches the administrator's SameSite=Lax session cookies, and Admidio processes the request as authenticated. The server resets the targeted user's password and emails the new credentials to that user with no further interaction from the administrator. See the GitHub Security Advisory for the technical write-up.

Detection Methods for CVE-2026-47228

Indicators of Compromise

Unexpected send_login requests in web server access logs targeting modules/registration.php from external referrers
User reports of unsolicited password reset emails originating from Admidio
Recent updates to adm_users.usr_password values for accounts not scheduled for administrative password resets

Detection Strategies

Review HTTP access logs for POST or GET requests to modules/registration.php with mode=send_login and correlate the Referer header against expected internal origins
Alert when an authenticated administrator session issues a send_login action shortly after visiting an external URL
Compare the frequency of send_login events against baseline administrator activity to surface anomalous spikes

Monitoring Recommendations

Enable audit logging for all password reset events on user accounts and forward the logs to a centralized SIEM
Monitor outbound mail from the Admidio host for unexpected credential-bearing messages
Track administrator browsing telemetry against Admidio request timestamps to identify cross-site trigger patterns

How to Mitigate CVE-2026-47228

Immediate Actions Required

Upgrade Admidio to version 5.0.10 or later on all instances
Instruct registration-administrators to log out of Admidio when not actively using it and to avoid browsing untrusted sites in the same browser session
Audit adm_users records and password reset emails for signs of unauthorized send_login invocations

Patch Information

Admidio version 5.0.10 adds the missing SecurityUtils::validateCsrfToken() call to the send_login branch, aligning it with the other state-changing modes in modules/registration.php. Refer to the GitHub Security Advisory GHSA-mx25-j3rc-6w2w for the fix reference.

Workarounds

Restrict access to the Admidio administrative interface using network-level controls such as VPN or IP allowlisting
Configure the session cookie with SameSite=Strict where operationally feasible to block cross-site top-level navigations from carrying credentials
Require administrators to use a dedicated browser or profile solely for Admidio administration until the patch is applied

bash

# Configuration example: upgrade Admidio to the fixed release
cd /var/www/admidio
git fetch --tags
git checkout v5.0.10
# Then run the Admidio update workflow via the web installer