CVE-2026-47229
Received Received - Intake

Cross-Site Request Forgery in Admidio SSO Client

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description
Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/sso/clients.php` validates an `adm_csrf_token` on every state-changing branch except `enable`. The `enable` case loads the SAML or OIDC client by UUID, calls `$client->enable($enabled)`, and persists the new state with no token check. Because the action is reachable via plain GET parameters, a third-party page can trick an authenticated administrator into disabling (or silently re-enabling) any configured SAML or OIDC client. Disabling an SSO client breaks every downstream relying-party application that authenticates through it. Version 5.0.10 contains a fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-47229
EUVD
EUVD-2026-57206

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
admidio admidio to 5.0.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in Admidio versions before 5.0.10. The `enable` case in `modules/sso/clients.php` does not validate a CSRF token before toggling the enabled status of SAML or OIDC clients. Attackers can trick authenticated administrators into disabling or re-enabling clients via malicious URLs.

Detection Guidance

Check Admidio version with: grep -r "version" /path/to/admidio/version.php. If <= 5.0.9, the system is vulnerable. Review logs for suspicious GET requests to /modules/sso/clients.php with mode=enable and client UUID parameters.

Impact Analysis

An attacker could disable a critical SAML or OIDC client, breaking authentication for downstream applications that rely on it. Alternatively, they could silently re-enable a disabled client, potentially causing unintended access. The attack requires tricking an authenticated admin into visiting a crafted link.

Compliance Impact

Disabling an SSO client could lead to unauthorized access or service outages, violating availability and integrity requirements in GDPR and HIPAA. Re-enabling a disabled client might also breach access control policies, risking compliance violations.

Mitigation Strategies

Upgrade Admidio to version 5.0.10 or later immediately. Ensure CSRF tokens are validated in all state-changing operations. Change GET requests to POST for enabling/disabling clients. Review and update JavaScript to include CSRF tokens in toggle requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47229. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart