CVE-2026-32755
CSRF Vulnerability in Admidio Allows Unauthorized Membership Modification
Publication date: 2026-03-19
Last updated on: 2026-03-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| admidio | admidio | to 5.0.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Admidio versions 5.0.6 and below, specifically in the save_membership action within the modules/profile/profile_function.php file. The action saves changes to a member's role membership start and end dates but fails to validate the CSRF (Cross-Site Request Forgery) token.
While other actions like stop_membership and remove_former_membership check the CSRF token, save_membership does not. Because membership UUIDs are visible in the HTML source to authenticated users, an attacker can craft a malicious POST form on an external page and trick a role leader into submitting it.
This allows the attacker to silently alter membership dates for any member of roles the victim leads without confirmation, notification, or administrative approval.
How can this vulnerability impact me? :
The vulnerability allows an attacker to exploit a role leader's session via CSRF to manipulate membership dates of any member within roles the victim leads.
- Terminate access by backdating membership end dates.
- Covertly extend unauthorized access by backdating membership start dates.
- Revoke role-restricted features without any confirmation or notification.
All these actions can be done silently, potentially disrupting user access and role management without administrative oversight.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Admidio to version 5.0.7 or later, where the issue has been fixed.
Until the upgrade can be applied, restrict role leaders' access or monitor for suspicious changes to membership dates, as the vulnerability allows CSRF attacks to silently alter membership roles.