github.com
https://github.com/Admidio/admidio CVE-2026-47232
MEDIUM
Admidio PKCS#12 private key export action lacks CSRF protection
Record summary
CVE-2026-47232 has a selected CVSS score of 4.3 (medium).
Description
Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive `mode=export` action in `modules/sso/keys.php` exports a PKCS#12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an administrator session can therefore trigger private key export without a valid form token. Version 5.0.10 contains a fix.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 12, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
admidioBrowse Admidio / admidio | CVE List | < 5.0.10 | affected |
admidio/admidioBrowse Packagist / admidio/admidio | GitHub Advisory | Before 5.0.10 · Fixed in 5.0.10 | affected |
References
4github.com
https://github.com/Admidio/admidio/blob/v5.0.9/modules/sso/keys.php github.com
https://github.com/Admidio/admidio/blob/v5.0.9/src/SSO/Service/KeyService.php github.comConfirmation
https://github.com/Admidio/admidio/security/advisories/GHSA-4rgq-38mh-9xqg