CVE-2026-53760: Admidio CSRF Vulnerability

CVE-2026-53760 Overview

CVE-2026-53760 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting Admidio, an open-source user management solution. The modules/plugins.php endpoint processes plugin installation, uninstallation, and update actions through GET requests without validating a CSRF token. Because these operations occur through top-level navigation, browsers attach SameSite=Lax session cookies to the request. An attacker who lures an authenticated administrator to a malicious page can trigger arbitrary plugin operations, including uninstall actions that execute DROP TABLE SQL scripts. The issue affects Admidio versions 5.0.11 and prior and is fixed in commit 056b1bd.

Critical Impact
A single click by an authenticated administrator on an attacker-controlled page can destroy plugin data and drop database tables in the Admidio instance.

Affected Products

Admidio open-source user management platform
Admidio versions 5.0.11 and prior
Deployments exposing modules/plugins.php to administrator sessions

Discovery Timeline

2026-09-04 - CVE-2026-53760 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-53760

Vulnerability Analysis

The vulnerability resides in the plugin management workflow of Admidio. The modules/plugins.php endpoint accepts mode, name, and uuid parameters via $_GET and performs state-changing operations without requiring a CSRF token. Supported modes include install, uninstall, update, and sequence. The uninstall mode executes SQL scripts that drop plugin tables and destroy associated data. Because the actions execute on GET requests, an attacker can embed the target URL in an <img>, <iframe>, or automatic redirect to trigger the request from any origin. Modern browsers still transmit SameSite=Lax cookies during top-level navigation, so administrator session cookies accompany the forged request. The result is an integrity and availability impact against the Admidio installation.

Root Cause

The root cause is missing anti-CSRF token validation on a state-changing endpoint combined with the use of GET requests for destructive operations. This design does not comply with defense-in-depth guidance that requires unpredictable per-session tokens on any operation that modifies server state.

Attack Vector

Exploitation requires an authenticated administrator to visit an attacker-controlled page. Once loaded, the page issues a request to the victim Admidio instance targeting modules/plugins.php with a chosen mode and plugin identifier. The browser attaches the administrator session cookie, and the server performs the requested plugin action.

php

// Patch excerpt from commit 056b1bd9f — modules/plugins.php
// The endpoint now uses POST data and enforces CSRF protection.

    // Initialize and check the parameters
    $getMode = admFuncVariableIsValid($_GET, 'mode', 'string', array('defaultValue' => 'list', 'validValues' => array('list', 'install', 'uninstall', 'update', 'sequence')));
-    $getPluginName = admFuncVariableIsValid($_GET, 'name', 'string', array('defaultValue' => ''));
-    $getPluginId = admFuncVariableIsValid($_GET, 'uuid', 'int');

    // check rights to use this module
    if (!$gCurrentUser->isAdministrator()) {

Source: GitHub Commit 056b1bd9f

Detection Methods for CVE-2026-53760

Indicators of Compromise

Web server access logs showing GET requests to modules/plugins.php with mode=install, mode=uninstall, or mode=update parameters originating from external Referer headers.
Unexpected DROP TABLE statements in database audit logs correlated with administrator sessions.
Missing or newly created plugin directories under the Admidio installation without a corresponding administrator action in the application audit trail.

Detection Strategies

Alert on HTTP requests to modules/plugins.php where the Referer header points to an untrusted origin or is absent.
Correlate administrator authentication events with plugin state changes to identify actions that lack a preceding administrative UI interaction.
Deploy web application firewall (WAF) rules that flag state-changing GET parameters (mode=uninstall, mode=install) against the vulnerable path.

Monitoring Recommendations

Enable verbose logging on Admidio's plugin subsystem and forward logs to a centralized SIEM for correlation.
Monitor database schema changes and alert on DROP TABLE events tied to the Admidio schema.
Track browser origin patterns for administrator sessions and investigate anomalies such as cross-site navigations immediately preceding plugin operations.

How to Mitigate CVE-2026-53760

Immediate Actions Required

Upgrade Admidio to the release that includes commit 056b1bd9f or later, which adds CSRF protection and moves plugin operations to POST.
Restrict access to modules/plugins.php at the reverse-proxy or WAF layer to trusted administrative source addresses.
Advise administrators to log out of Admidio when not actively managing the instance and to avoid clicking untrusted links while authenticated.

Patch Information

The vulnerability is fixed in commit 056b1bd9f995437395e337d2c73a32e5c96ee616. Details are available in the GitHub Security Advisory GHSA-hm42-q32m-vj4f and the corresponding GitHub Commit 056b1bd9f. The patch removes GET-based parameter parsing for plugin identifiers and enforces CSRF token validation on state-changing operations.

Workarounds

Block external HTTP requests to modules/plugins.php using a WAF rule that requires a same-origin Referer or Origin header.
Enforce short administrator session lifetimes and require re-authentication before privileged actions.
Isolate administrative access behind a VPN or IP allowlist to reduce exposure to drive-by CSRF payloads.

bash

# Example nginx rule to block cross-origin requests to the plugins endpoint
location = /modules/plugins.php {
    if ($http_origin !~* ^https?://admidio\.example\.com$) {
        return 403;
    }
    # Prefer applying the vendor patch; this rule is a temporary control.
}