CVE-2026-47232
Received Received - Intake

Private Key Exposure via CSRF in Admidio

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description
Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive `mode=export` action in `modules/sso/keys.php` exports a PKCS#12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an administrator session can therefore trigger private key export without a valid form token. Version 5.0.10 contains a fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-47232
EUVD
EUVD-2026-57209

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
admidio admidio to 5.0.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Admidio versions prior to 5.0.10 allows an attacker to export a private key and certificate as a PKCS#12 bundle without proper CSRF protection. The CSRF validation line in the code is commented out, enabling a forged cross-site POST request from an administrator session to trigger the export.

Detection Guidance

Check for unauthorized PKCS#12 exports in Admidio logs, particularly for the mode=export action in modules/sso/keys.php. Look for POST requests to this endpoint without valid CSRF tokens. Verify if private keys or certificates were exported unexpectedly.

Impact Analysis

An attacker could trick an administrator into visiting a malicious page, causing their browser to export sensitive private keys and certificates. This could lead to unauthorized access, data breaches, or impersonation attacks if the exported keys are compromised.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using affected versions may face compliance violations and legal consequences.

Mitigation Strategies

Upgrade Admidio to version 5.0.10 or later to restore CSRF protection. Review logs for any suspicious export actions. Ensure administrators are aware of phishing risks targeting SSO credentials.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47232. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart