CVE-2026-69093
Received Received - Intake

Persistent Category Report Configuration Changes in Admidio

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulnCheck

Description
Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters (delete and copy). An attacker can trick an authenticated administrator into visiting a crafted URL to delete or duplicate Category Report configurations, affecting the integrity and availability of that module's configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-69093
EUVD
EUVD-2026-52286

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
admidio admidio to 5.0.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Admidio before version 5.0.11 has a vulnerability where the adm_csrf_token is not validated in the Category Report configuration module. This allows an attacker to trick an authenticated administrator into visiting a malicious URL, which can delete or duplicate Category Report configurations through GET parameters.

Detection Guidance

Check Admidio version for 5.0.11 or higher. Review server logs for suspicious GET requests to modules/category-report/preferences.php with delete or copy parameters. Look for unauthorized changes in Category Report configurations.

Impact Analysis

This vulnerability can lead to unauthorized deletion or duplication of Category Report configurations, potentially disrupting the functionality and availability of the module. It requires an authenticated administrator to be tricked into clicking a crafted link.

Compliance Impact

This vulnerability does not directly impact GDPR or HIPAA compliance as it involves unauthorized configuration changes to a specific module by an authenticated administrator. However, if Category Report configurations include personal or sensitive data handling settings, integrity issues could indirectly affect compliance.

Mitigation Strategies

Upgrade Admidio to version 5.0.11 or later. Restrict access to the modules/category-report/preferences.php endpoint. Monitor configuration changes and audit logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69093. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart