SB20260721118 - Cross-site request forgery in Admidio

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260721118

SB20260721118 - Cross-site request forgery in Admidio

Published: July 21, 2026

Security Bulletin ID SB20260721118
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Cross-site request forgery (CVE-ID: CVE-2026-53760)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to perform unauthorized plugin install, uninstall, and update operations.

The vulnerability exists due to cross-site request forgery in modules/plugins.php when handling top-level GET requests for plugin management actions. A remote privileged user can trick an administrator into visiting a crafted web page to perform unauthorized plugin install, uninstall, and update operations.

User interaction is required, and the issue affects install, uninstall, and update actions triggered through the mode and name parameters.


Remediation

Install update from vendor's website.

References