CVE-2026-47232 Overview
CVE-2026-47232 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in Admidio, an open-source user management solution. The flaw exists in modules/sso/keys.php prior to version 5.0.10. The mode=export action returns a PKCS#12 bundle containing the configured private key and certificate, but the CSRF validation call is commented out in the vulnerable code path. An attacker who convinces an authenticated administrator to visit a malicious page can trigger export of the Single Sign-On (SSO) private key without a valid form token. Version 5.0.10 contains the fix.
Critical Impact
A forged cross-site POST from an administrator session exports the SSO PKCS#12 private key and certificate, exposing the cryptographic material that underpins federated authentication.
Affected Products
- Admidio versions prior to 5.0.10
- Admidio SSO key management module (modules/sso/keys.php)
- Admidio KeyService component (src/SSO/Service/KeyService.php)
Discovery Timeline
- 2026-08-12 - CVE-2026-47232 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-47232
Vulnerability Analysis
Admidio exposes an SSO key management interface that allows administrators to export the platform's signing key material as a PKCS#12 bundle. The export path in modules/sso/keys.php handles the mode=export action and calls into KeyService to package the private key and X.509 certificate. In releases up to and including 5.0.9, the CSRF token check that should gate this action is present in the source but commented out. The endpoint therefore accepts state-changing POST requests based solely on the administrator's authenticated session cookie.
Because browsers automatically attach session cookies to cross-origin requests, an attacker-hosted page can auto-submit a form targeting the export endpoint. The response is a downloadable PKCS#12 file containing the private key used to sign SSO assertions. Recovery of that key allows an attacker to forge authentication tokens accepted by any relying party that trusts the Admidio instance.
Root Cause
The root cause is a missing anti-CSRF token validation on a sensitive state-exposing endpoint [CWE-352]. The developer left the token verification call disabled, so the handler executes without confirming that the request originated from the Admidio administrative interface. See the GitHub Security Advisory GHSA-4rgq-38mh-9xqg and the vulnerable source in keys.php.
Attack Vector
Exploitation requires an authenticated administrator to load attacker-controlled content in the same browser as an active Admidio session. The malicious page submits a hidden form or issues a fetch request to the mode=export endpoint. The browser attaches the admin session cookie, the server processes the export without a token check, and the private key material is returned. No credentials, brute force, or server-side foothold are required.
Detection Methods for CVE-2026-47232
Indicators of Compromise
- Unexpected HTTP requests to modules/sso/keys.php with the mode=export parameter from admin sessions.
- HTTP Referer or Origin headers on export requests that do not match the Admidio host.
- Web server access logs showing PKCS#12 download responses outside of scheduled administrative activity.
- SSO relying-party logs showing authentication assertions signed with the exported key from unexpected sources.
Detection Strategies
- Alert on any request to the SSO keys export endpoint that lacks the expected CSRF token parameter.
- Correlate administrator session activity with the client IP and User-Agent that triggered export events.
- Review historical logs for prior mode=export invocations that may indicate pre-patch exploitation.
Monitoring Recommendations
- Forward Admidio web server access logs to a centralized SIEM and build detections for the export endpoint.
- Monitor SSO identity providers and relying parties for anomalous assertion issuers or unexpected signing key usage.
- Track administrator account activity for browser sessions that visit untrusted external sites during admin work.
How to Mitigate CVE-2026-47232
Immediate Actions Required
- Upgrade Admidio to version 5.0.10 or later, which restores CSRF token validation on the export handler.
- Rotate the SSO signing key and certificate if the pre-patch version was exposed on a reachable network.
- Re-issue trust material to all SSO relying parties after rotation and revoke the prior certificate.
- Audit web and application logs for any prior invocation of modules/sso/keys.php?mode=export.
Patch Information
The fix is published in Admidio 5.0.10. The vendor advisory and code references are available in the GitHub Security Advisory GHSA-4rgq-38mh-9xqg, with the affected implementation documented in modules/sso/keys.php and KeyService.php.
Workarounds
- Restrict access to the Admidio administrative interface to an internal network segment or VPN.
- Require administrators to use a dedicated browser or profile for Admidio administration to reduce cross-site exposure.
- Deploy a web application firewall rule that blocks requests to modules/sso/keys.php when the Origin or Referer header does not match the Admidio host.
- Temporarily remove or restrict file permissions on modules/sso/keys.php until the upgrade is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
