EIP-2026-104955

This exploit demonstrates a Cross-Site Request Forgery (CSRF) vulnerability in Admidio 3.3.5, allowing low-privilege users to escalate their permissions by submitting a crafted form to the roles_function.php endpoint. The PoC includes a pre-filled HTML form that modifies role permissions when submitted by an authenticated user.