CVE-2026-69093 in Admidio
Summary
by MITRE • 08/03/2026
Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters (delete and copy). An attacker can trick an authenticated administrator into visiting a crafted URL to delete or duplicate Category Report configurations, affecting the integrity and availability of that module's configuration.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability exists in Admidio versions prior to 5.0.11 where the application fails to properly validate the adm_csrf_token parameter in the modules/category-report/preferences.php file. The flaw allows for unauthorized modification of Category Report configurations through manipulation of GET parameters, specifically targeting delete and copy operations that affect persistent configuration data. The absence of proper CSRF token validation creates a significant security risk as it enables attackers to perform unintended administrative actions without proper authorization.
The technical implementation of this vulnerability stems from the application's insufficient input validation mechanisms within the preference management module. When an authenticated administrator visits a maliciously crafted URL containing manipulated GET parameters, the system processes these requests without verifying the authenticity of the request through the expected CSRF token validation. This design flaw directly violates security best practices for protecting against cross-site request forgery attacks and demonstrates poor application logic for handling administrative configuration changes.
The operational impact of this vulnerability extends beyond simple data modification to encompass both integrity and availability concerns within the Category Report module. An attacker can exploit this weakness to delete critical configuration entries, potentially disrupting reporting functionality or removing essential settings that administrators have carefully configured. Additionally, the ability to duplicate configurations allows for unauthorized creation of duplicate reports, which could lead to system clutter, resource exhaustion, or more sophisticated attacks that leverage the duplicated configurations for further exploitation.
This vulnerability aligns with CWE-352 Cross-Site Request Forgery and maps to ATT&CK technique T1078 Valid Accounts, as it requires an authenticated administrator session to be effective. The attack vector typically involves social engineering where administrators are tricked into visiting malicious URLs through phishing campaigns or compromised websites. Organizations using affected Admidio versions face risks of unauthorized administrative actions that could compromise the integrity of their reporting systems and potentially serve as a foothold for more extensive attacks within their administrative environments.
The recommended mitigation strategies include implementing proper CSRF token validation throughout the application's administrative interfaces, ensuring all configuration changes require valid authentication tokens, and upgrading to Admidio version 5.0.11 or later where this vulnerability has been addressed. Security teams should also conduct thorough code reviews to identify similar CSRF vulnerabilities in other modules and implement comprehensive input validation mechanisms that align with OWASP Top Ten security recommendations for preventing cross-site request forgery attacks.