Summaryinfo

A vulnerability, which was classified as problematic, was found in admidio up to 5.0.7. This affects the function create_user/assign_member/assign_user of the file modules/registration.php of the component URL Handler. The manipulation results in cross-site request forgery. This vulnerability is known as CVE-2026-34384. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in admidio up to 5.0.7. Affected is the function create_user/assign_member/assign_user of the file modules/registration.php of the component URL Handler. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. CWE is classifying the issue as CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This is going to have an impact on integrity. CVE summarizes:

Admidio is an open-source user management solution. Prior to version 5.0.8, the create_user, assign_member, and assign_user action modes in modules/registration.php approve pending user registrations via GET request without validating a CSRF token. Unlike the delete_user mode in the same file (which correctly validates the token), these three approval actions read their parameters from $_GET and perform irreversible state changes without any protection. An attacker who has submitted a pending registration can extract their own user UUID from the registration confirmation email URL, then trick any user with the rol_approve_users right into visiting a crafted URL that automatically approves the registration. This bypasses the manual registration approval workflow entirely. This issue has been patched in version 5.0.8.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-34384 since 03/27/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation requires an enhanced level of successful authentication. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

By approaching the search of inurl:modules/registration.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 5.0.8 eliminates this vulnerability. Applying the patch 707171c188b3e8f36007fc3f2bccbfac896ed019 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• admidio

Version

• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6
• 5.0.7

License

• open-source

Website

• Product: https://github.com/Admidio/admidio/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion