CVE-2026-47234: Admidio Information Disclosure Flaw

CVE-2026-47234 Overview

CVE-2026-47234 is an information disclosure vulnerability in Admidio, an open-source user management platform. Versions prior to 5.0.10 write full session cookie values and active session IDs to debug logs. When debug logging is enabled, Session::setCookie() records complete cookie values and Session::start() records the current session identifier. In production deployments, the exposed data includes both the active session cookie and the persistent auto-login cookie. Any actor with access to the log sink can extract live bearer-style credentials and impersonate authenticated users. The issue is classified as [CWE-200] Information Exposure. Admidio 5.0.10 resolves the issue.

Critical Impact
An attacker with read access to Admidio debug logs can recover live session and auto-login cookies, enabling full account takeover without further authentication.

Affected Products

Admidio versions prior to 5.0.10
Admidio deployments with debug logging enabled
Session::setCookie() and Session::start() in src/Session/Entity/Session.php

Discovery Timeline

2026-08-12 - CVE-2026-47234 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-47234

Vulnerability Analysis

Admidio uses PHP session management to authenticate users and support persistent auto-login. When debug logging is enabled, the session-handling code emits diagnostic entries that contain the raw values of security-sensitive cookies. These entries are written to whatever log sink the deployment configures, such as local files, syslog, or a centralized log aggregator.

Because both the session cookie and the auto-login cookie act as bearer credentials, any observer of the log stream can replay them to gain authenticated access. The auto-login cookie is especially valuable because it grants long-lived access without requiring the original password.

The attack does not require exploitation of the Admidio web application itself. It only requires read access to the debug log, which is often granted to system administrators, developers, backup operators, and SIEM ingestion pipelines. The exposure widens the effective trust boundary of the authentication system to include everyone who can read logs.

Root Cause

The root cause is unsanitized logging of sensitive data. In src/Session/Entity/Session.php, the routines at lines 533-540 and 615-617 log cookie payloads and session identifiers verbatim rather than redacting or hashing them. See the Admidio Security Advisory GHSA-mch8-wf3h-6x88 for the vendor's technical description.

Attack Vector

The vulnerability requires local access with high privileges, meaning an attacker must already have the ability to read the log sink. Common attack paths include a compromised low-tier operations account with log read access, a misconfigured log share, a shared SIEM index accessible to non-administrative users, or backup archives that include debug logs. Once the attacker recovers a cookie value, they set it in a browser or HTTP client and issue requests as the victim.

The vulnerability manifests in the session lifecycle logging paths referenced above. See the linked Admidio source snippets and advisory for exact technical details rather than synthetic reproduction code.

Detection Methods for CVE-2026-47234

Indicators of Compromise

Log entries from Session::setCookie() or Session::start() containing full cookie values or session IDs
Concurrent authenticated sessions for the same user account from different source IP addresses
Requests presenting a valid session or auto-login cookie without a preceding login event in the access logs
Unexpected access to Admidio debug log files, log shares, or SIEM indexes by non-administrative accounts

Detection Strategies

Grep or query log stores for the string patterns produced by the vulnerable log lines and alert on any hits
Correlate Admidio access logs with authentication events to surface sessions that were never established through a login
Baseline expected readers of the log sink and alert on new principals accessing debug logs
Review file-integrity and access-audit records for log files on Admidio hosts

Monitoring Recommendations

Enable audit logging on directories that store Admidio debug output and forward events to a central SIEM
Track session cookie reuse across disparate user agents or geolocations
Monitor for enabling of Admidio debug mode in production configurations

How to Mitigate CVE-2026-47234

Immediate Actions Required

Upgrade Admidio to version 5.0.10 or later
Disable debug logging in production Admidio deployments until upgraded
Rotate all active session cookies and invalidate persistent auto-login tokens after upgrade
Review historical debug logs for exposed cookies and purge or restrict them

Patch Information

Admidio 5.0.10 contains the fix. The maintainers modified the session logging routines so cookie values and session identifiers are no longer written to logs. Review the Admidio Security Advisory GHSA-mch8-wf3h-6x88 and the affected code paths in Session.php lines 533-540 and Session.php lines 615-617.

Workarounds

Set Admidio to a non-debug logging level in production configuration
Restrict filesystem permissions on Admidio log directories to the web server user only
Redact cookie and session identifier patterns at the log shipper before forwarding to SIEM
Force logout of all users and clear persistent login tokens if debug logs may have been exposed

bash

# Restrict access to Admidio log directory to the web server user
chown -R www-data:www-data /path/to/admidio/adm_my_files/logs
chmod 700 /path/to/admidio/adm_my_files/logs

# Disable debug logging in Admidio configuration (config.php)
# $gDebug = 0;