Cross-site request forgery in Admidio - CVE-2026-47229
Published: May 25, 2026
Vulnerability identifier: #VU132285
CSH Severity: Medium
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-47229
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a partial denial of service and modify the enabled state of an SSO client.
The vulnerability exists due to cross-site request forgery in modules/sso/clients.php enable mode when handling state-changing requests via GET parameters without CSRF token validation. A remote attacker can trick an authenticated administrator into visiting a crafted page to cause a partial denial of service and modify the enabled state of an SSO client.
User interaction is required, and the issue affects SAML and OIDC client enable or disable operations identified by UUID.
Affected software
Admidio
How to mitigate CVE-2026-47229
Install security update from vendor's website.
Admidio - update to 5.0.10