CVE-2026-47229 in Admidio
Summary
by MITRE • 08/12/2026
Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/sso/clients.php` validates an `adm_csrf_token` on every state-changing branch except `enable`. The `enable` case loads the SAML or OIDC client by UUID, calls `$client->enable($enabled)`, and persists the new state with no token check. Because the action is reachable via plain GET parameters, a third-party page can trick an authenticated administrator into disabling (or silently re-enabling) any configured SAML or OIDC client. Disabling an SSO client breaks every downstream relying-party application that authenticates through it. Version 5.0.10 contains a fix.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability exists within the Admidio user management solution's single sign-on implementation where improper access control validation creates a critical security flaw in the client enabling process. The affected file modules/sso/clients.php demonstrates a classic csrf token validation inconsistency that violates fundamental web application security principles. While the system correctly implements csrf protection for most state-changing operations, it fails to validate the adm_csrf_token parameter specifically for the enable action, creating an exploitable gap in the authorization framework.
This vulnerability manifests through a flawed authentication flow where the enable case processes client state changes without proper token verification, relying solely on the presence of a UUID parameter passed via GET request. The absence of csrf protection in this particular code path allows attackers to construct malicious URLs that, when visited by an authenticated administrator, silently modify SAML or OIDC client configurations. The vulnerability is particularly dangerous because it operates through standard web browser mechanisms without requiring any special privileges beyond authentication access.
The operational impact of this vulnerability extends far beyond simple configuration changes, potentially causing cascading failures across downstream applications that depend on the affected SSO clients. When an SSO client is disabled, all relying-party applications that authenticate users through that service experience complete authentication failures, effectively breaking access to multiple systems simultaneously. This represents a significant business continuity risk and demonstrates how a single misconfiguration can compromise entire application ecosystems.
Security researchers should note this vulnerability aligns with CWE-352, which specifically addresses Cross-Site Request Forgery weaknesses in web applications. The flaw also maps to ATT&CK technique T1548.002, which covers abuse of cloud service roles and privileges through manipulation of authentication services. Organizations implementing Admidio should immediately update to version 5.0.10 or later where the fix properly validates csrf tokens for all state-changing operations including the enable action. The remediation approach demonstrates proper defense-in-depth principles by ensuring consistent access control validation across all code paths that modify critical system configurations.
The vulnerability highlights the importance of comprehensive csrf protection implementation, particularly in multi-tenant systems where administrative functions directly impact downstream services. It serves as a reminder that even seemingly minor configuration changes can create significant security risks when proper authorization controls are not consistently applied. Organizations should conduct thorough security reviews of their authentication and authorization mechanisms to identify similar inconsistencies that could allow privilege escalation or service disruption attacks.