CVE-2026-47228 in Admidio
Summary
by MITRE • 08/12/2026
Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random password for `user_uuid_assigned`, stores its bcrypt hash in `adm_users.usr_password`, and emails the cleartext to that user. Every other state-changing mode in the same file (`assign_member`, `assign_user`, `delete_user`, `create_user`) calls `SecurityUtils::validateCsrfToken($_POST['adm_csrf_token'])` first; the `send_login` branch does not. Prior to version 5.0.10, page visited by a registration-administrator can issue the request as a top-level navigation, the browser sends the admin's `SameSite=Lax` cookies, and the server resets the chosen user's password without any further interaction from the admin. Version 5.0.10 fixes the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability in Admidio's registration module presents a critical cross-site request forgery flaw that allows unauthorized password resets for user accounts. This security weakness exists specifically in the send_login functionality within modules/registration.php where the system regenerates random passwords and emails them in cleartext to users without proper CSRF protection. The technical implementation fails to validate CSRF tokens for this particular function while all other state-changing operations in the same file properly implement SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']) validation, creating an inconsistent security posture that exposes the system to malicious exploitation.
The operational impact of this vulnerability enables attackers to perform unauthorized password resets against any user account accessible through the registration administrator interface. The flaw operates through a simple HTTP request manipulation where an attacker can craft a malicious request that leverages the browser's automatic sending of SameSite=Lax cookies when navigating directly to the vulnerable endpoint. This allows the attack to execute without requiring additional authentication steps or explicit user interaction, effectively bypassing all security controls that should normally protect against such operations. The vulnerability is particularly dangerous because it operates in a privileged administrative context where the attacker can target any user account within the system.
This vulnerability maps directly to CWE-352 Cross-Site Request Forgery and aligns with ATT&CK technique T1566.002 for credential access through social engineering, though the actual exploitation here occurs through automated request manipulation rather than traditional social engineering. The flaw demonstrates a critical failure in input validation and state management where the system fails to properly verify the authenticity of requests before executing sensitive operations. The CSRF protection mechanism is completely absent from the send_login branch while it exists for all other similar functions, creating an exploitable gap in the application's security architecture that directly violates secure coding practices.
Mitigation strategies should focus on implementing proper CSRF token validation across all state-changing operations within the registration module, ensuring consistent security controls throughout the codebase. The immediate fix implemented in version 5.0.10 correctly addresses this by adding CSRF token validation to the send_login function, aligning its security posture with other operations in the same file. Organizations should also implement additional monitoring for unauthorized password reset activities and consider implementing rate limiting on password reset requests to further reduce the attack surface. The fix demonstrates the importance of maintaining consistent security controls across all application functions and highlights how seemingly minor oversights in code implementation can create significant security vulnerabilities that expose user credentials to unauthorized access.