Cross-site request forgery in Admidio - CVE-2026-53760
Published: July 21, 2026
Vulnerability identifier: #VU138934
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-53760
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Admidio
Affected software:
Admidio
Admidio
Detailed vulnerability description
The vulnerability allows a remote user to perform unauthorized plugin install, uninstall, and update operations.
The vulnerability exists due to cross-site request forgery in modules/plugins.php when handling top-level GET requests for plugin management actions. A remote privileged user can trick an administrator into visiting a crafted web page to perform unauthorized plugin install, uninstall, and update operations.
User interaction is required, and the issue affects install, uninstall, and update actions triggered through the mode and name parameters.
How to mitigate CVE-2026-53760
Install security update from vendor's website.