CVE-2026-53760
Received Received - Intake

Admidio Plugin Uninstall CSRF Vulnerability

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: GitHub, Inc.

Description
Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include SameSite=Lax session cookies. An attacker crafts a malicious page that, when an authenticated administrator visits it, triggers arbitrary plugin operations. The uninstall operation executes DROP TABLE SQL scripts and destroys plugin data. This issue has been patched via commit 056b1bd.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-53760
EUVD
EUVD-2026-71630

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
admidio admidio to 5.0.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Admidio versions 5.0.11 and prior have a vulnerability in the modules/plugins.php endpoint. It allows plugin installation, uninstallation, and updates via GET requests without CSRF token validation. Attackers can exploit this by tricking an authenticated administrator into visiting a malicious page, which triggers arbitrary plugin operations. The uninstall operation runs DROP TABLE SQL scripts, destroying plugin data.

Detection Guidance

Check Admidio version for 5.0.11 or prior. Inspect server logs for unusual plugin operations or SQL DROP TABLE commands. Monitor network traffic for GET requests to modules/plugins.php without CSRF tokens.

Impact Analysis

If you are an administrator using Admidio 5.0.11 or earlier, an attacker could exploit this to uninstall plugins, delete plugin data, or perform unauthorized actions. This could disrupt your system's functionality or lead to data loss.

Mitigation Strategies

Upgrade Admidio to a version beyond 5.0.11 where the patch is applied. Disable plugin installation/uninstallation via GET requests. Implement CSRF token validation for all plugin operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53760. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart