CVE-2026-69093

MEDIUM

Admidio before 5.0.11 CSRF via category-report preferences

Title source: cna
STIX 2.1

Description

Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters (delete and copy). An attacker can trick an authenticated administrator into visiting a crafted URL to delete or duplicate Category Report configurations, affecting the integrity and availability of that module's configuration.

References (3)

Core 3
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-mvx3-m6p6-7r9w)
https://github.com/Admidio/admidio/security/advisories/GHSA-mvx3-m6p6-7r9w
Third Party Advisory third-party-advisory
VulnCheck Advisory: Admidio before 5.0.11 CSRF via category-report preferences
https://www.vulncheck.com/advisories/admidio-before-csrf-via-category-report-preferences

Scores

CVSS v3 4.6
EPSS 0.0011
EPSS Percentile 1.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-352
Status published
Products (2)
Admidio/admidio < 5.0.11
Admidio/admidio 5.0.11
Published Aug 03, 2026
Tracked Since Aug 03, 2026