CVE-2026-34383 in admidio

要約 (英語)

Admidio is an open-source user management solution. Prior to version 5.0.8, the inventory module's item_save endpoint accepts a user-controllable POST parameter imported that, when set to true, completely bypasses both CSRF token validation and server-side form validation. An authenticated user can craft a direct POST request to save arbitrary inventory item data without CSRF protection and without the field value checks that the FormPresenter validation normally enforces. This issue has been patched in version 5.0.8.

責任者

GitHub_M

予約する

2026年03月27日

公開

2026年04月01日

エントリ

VulDB provides additional information and datapoints for this CVE:

識別子	脆弱性	CWE	悪用可	対策	CVE
354517	admidio Inventory item_save クロスサイトリクエストフォージェリ	352	未定義	公式な修正	CVE-2026-34383