CVE-2026-47228
Received Received - Intake

CSRF Bypass in Admidio Password Reset

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description
Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random password for `user_uuid_assigned`, stores its bcrypt hash in `adm_users.usr_password`, and emails the cleartext to that user. Every other state-changing mode in the same file (`assign_member`, `assign_user`, `delete_user`, `create_user`) calls `SecurityUtils::validateCsrfToken($_POST['adm_csrf_token'])` first; the `send_login` branch does not. Prior to version 5.0.10, page visited by a registration-administrator can issue the request as a top-level navigation, the browser sends the admin's `SameSite=Lax` cookies, and the server resets the chosen user's password without any further interaction from the admin. Version 5.0.10 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-47228
EUVD
EUVD-2026-57205

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
admidio admidio to 5.0.10 (exc)
admidio admidio From 5.0.0 (inc) to 5.0.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-47228 is a Cross-Site Request Forgery (CSRF) vulnerability in Admidio versions 5.0.9 and earlier. It affects the registration module's send_login mode, which resets user passwords without proper CSRF protection. An attacker can trick a registration-administrator into resetting any user's password by visiting a malicious link.

Detection Guidance

Check Admidio version with: grep -r 'version' /path/to/admidio/config. If version is 5.0.9 or earlier, the system is vulnerable. Review registration module logs for unexpected password reset emails or unauthorized password changes.

Impact Analysis

This vulnerability allows an attacker to reset any user's password without their consent. Victims may experience account lockout or denial-of-service as their passwords are replaced with server-generated ones. Unsolicited password reset emails could also be used in phishing attacks.

Compliance Impact

This vulnerability could lead to unauthorized password resets, potentially exposing user accounts to attackers. This may violate GDPR's data protection principles if personal data is accessed or modified without consent, and HIPAA's security requirements if user credentials are compromised.

Mitigation Strategies

Upgrade Admidio to version 5.0.10 or later immediately. Ensure all sensitive actions in registration.php enforce CSRF token validation. Monitor for unauthorized password resets and disable the send_login mode if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47228. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart