CVE-2026-47232
MEDIUM
4,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: low
Integrity: none
Availability: none
Description
AI Translation Available
Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive `mode=export` action in `modules/sso/keys.php` exports a PKCS#12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an administrator session can therefore trigger private key export without a valid form token. Version 5.0.10 contains a fix.
352
Cross-Site Request Forgery (CSRF)
StableCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Availability
Non-Repudiation
Access Control
Potential Impacts:
Gain Privileges Or Assume Identity
Bypass Protection Mechanism
Read Application Data
Modify Application Data
Dos: Crash, Exit, Or Restart
Applicable Platforms
Technologies:
Web Based, Web Server
https://github.com/Admidio/admidio/security/advisories/GHSA-4rgq-38mh-9xqg
https://github.com/Admidio/admidio/blob/v5.0.9/modules/sso/keys.php#L83-L94
https://github.com/Admidio/admidio/blob/v5.0.9/src/SSO/Service/KeyService.php#L…
https://github.com/Admidio/admidio/security/advisories/GHSA-4rgq-38mh-9xqg