CVE-2026-34384 - Vulnerability Analysis

Overview

Admidio < 5.0.8 contains a cross-site request forgery caused by missing CSRF token validation in create_user, assign_member, and assign_user actions in modules/registration.php, letting attackers bypass manual user registration approval, exploit requires victim with rol_approve_users right to visit crafted URL.

Severity & Score

Impact

Attackers can bypass manual user registration approval, allowing unauthorized user registrations to be approved automatically.

Mitigation

Update to version 5.0.8 or later.

References

• https://github.com/Admidio/admidio/commit/707171c188b3e8f36007fc3f2bccbfac896ed019
• https://github.com/Admidio/admidio/security/advisories/GHSA-ph84-r98x-2j22

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner