CVE-2026-69093: Admidio CSRF Vulnerability

CVE-2026-69093 Overview

CVE-2026-69093 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in Admidio versions before 5.0.11. The flaw resides in modules/category-report/preferences.php, which fails to validate the adm_csrf_token before processing state-changing GET parameters. Attackers can craft URLs that trigger delete or copy operations against Category Report configurations. Successful exploitation requires an authenticated administrator to visit an attacker-controlled link. The impact affects the integrity and availability of the Category Report module's configuration data.

Critical Impact
An authenticated administrator lured to a malicious URL can have Category Report configurations silently deleted or duplicated, disrupting reporting functions across the Admidio deployment.

Affected Products

Admidio versions before 5.0.11
modules/category-report/preferences.php component
Category Report module configurations

Discovery Timeline

2026-08-03 - CVE-2026-69093 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-69093

Vulnerability Analysis

Admidio is an open-source membership management application used by clubs and organizations. The Category Report module allows administrators to define, save, and manage reporting configurations. Its preferences handler, modules/category-report/preferences.php, accepts administrative actions through HTTP GET requests. The endpoint recognizes delete and copy parameters that persistently mutate stored configurations. Because the handler does not verify the adm_csrf_token value, any request bearing a valid administrator session cookie is honored, regardless of origin.

Root Cause

The root cause is missing CSRF token validation on a state-changing endpoint [CWE-352]. Admidio issues an adm_csrf_token for form submissions, but the Category Report preferences handler processes delete and copy operations directly from GET parameters without confirming the token. State-changing operations delivered over GET compound the exposure, since browsers automatically send session cookies with cross-origin image, link, and redirect requests.

Attack Vector

An attacker crafts a URL such as https://victim.example/adm_program/modules/category-report/preferences.php?mode=delete&crt_id=<id> and delivers it to an authenticated administrator through email, chat, forum post, or an embedded HTML element on an attacker-controlled page. When the administrator's browser loads the URL, the authenticated session executes the deletion or duplication action. No user interaction beyond visiting the resource is required, and no exploit tooling is publicly available at the time of publication.

The upstream fix is tracked in the Admidio project. Reference the GitHub Security Advisory GHSA-mvx3-m6p6-7r9w and the remediation commit for technical details of the patch.

text

<step id="500">UPDATE %PREFIX%_preferences SET prf_value = '1' WHERE prf_name = 'contacts_suborganization_use_same_members'</step>
<step>stop</step>

Source: Admidio commit e1fe6fd — excerpt from install/db_scripts/update_5_1.xml, part of the 5.0.11 update sequence that ships alongside the CSRF fix.

Detection Methods for CVE-2026-69093

Indicators of Compromise

Web server access logs showing GET requests to modules/category-report/preferences.php containing mode=delete or mode=copy parameters
Requests to the preferences endpoint with Referer headers pointing to external or unexpected domains
Unexplained removal or duplication of Category Report entries in the Admidio administrative interface
Administrator sessions issuing category-report state changes shortly after clicking external links

Detection Strategies

Alert on HTTP GET requests to category-report/preferences.php that carry action parameters (delete, copy) but lack an adm_csrf_token value
Correlate administrator authentication events with subsequent modifications to the adm_category_report database table
Baseline normal administrator workflow patterns and flag category-report changes initiated outside the standard UI flow

Monitoring Recommendations

Enable verbose PHP and web server logging for the adm_program/modules/category-report/ directory
Forward Admidio audit logs to a centralized SIEM for correlation with browsing telemetry from administrator workstations
Monitor for outbound clicks from administrator email or chat clients that resolve to Admidio deep links containing action parameters

How to Mitigate CVE-2026-69093

Immediate Actions Required

Upgrade Admidio to version 5.0.11 or later on all instances
Audit the Category Report module for missing or duplicated configurations that may indicate prior exploitation
Terminate active administrator sessions and require re-authentication after patching
Restrict administrative access to Admidio to trusted networks or via a VPN while patching is in progress

Patch Information

The issue is resolved in Admidio 5.0.11. The vendor fix adds CSRF token validation to the Category Report preferences handler. Review the GitHub Security Advisory GHSA-mvx3-m6p6-7r9w, the upstream commit, and the Vulncheck advisory for full remediation guidance.

Workarounds

Instruct administrators to log out of Admidio when not actively using it, reducing the window for CSRF exploitation
Deploy a Web Application Firewall (WAF) rule that blocks GET requests to category-report/preferences.php containing delete or copy parameters without a valid token
Enforce SameSite=Strict on Admidio session cookies at the reverse proxy layer to reduce cross-site request delivery
Segment administrative browsing sessions from general web browsing on the same workstation

bash

# Example NGINX rule to block unauthenticated action parameters at the edge
location ~ /modules/category-report/preferences\.php$ {
    if ($arg_mode ~* "^(delete|copy)$") {
        return 403;
    }
    proxy_pass http://admidio_backend;
}