CVE-2026-34383

Admidio is an open-source user management solution. Prior to version 5.0.8, the inventory module's item_save endpoint accepts a user-controllable POST parameter imported that, when set to true, completely bypasses both CSRF token validation and server-side form validation. An authenticated user can craft a direct POST request to save arbitrary inventory item data without CSRF protection and without the field value checks that the FormPresenter validation normally enforces. This issue has been patched in version 5.0.8.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Admidio/admidio/commit/00494b95dfe847af8b938e4397e5d909d8f36839	Patch
https://github.com/Admidio/admidio/security/advisories/GHSA-4rwm-c5mj-wh7x	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*

History

01 Apr 2026, 18:28

Type	Values Removed	Values Added
References	~~() https://github.com/Admidio/admidio/commit/00494b95dfe847af8b938e4397e5d909d8f36839 -~~	() https://github.com/Admidio/admidio/commit/00494b95dfe847af8b938e4397e5d909d8f36839 - Patch
References	~~() https://github.com/Admidio/admidio/security/advisories/GHSA-4rwm-c5mj-wh7x -~~	() https://github.com/Admidio/admidio/security/advisories/GHSA-4rwm-c5mj-wh7x - Exploit, Mitigation, Vendor Advisory
First Time		Admidio Admidio admidio
CPE		cpe:2.3:a:admidio:admidio::::::::

31 Mar 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-31 21:16

Updated : 2026-04-01 18:28

NVD link : CVE-2026-34383

Mitre link : CVE-2026-34383

CVE.ORG link : CVE-2026-34383

JSON object : View

Products Affected

admidio

admidio

CWE

CWE-20

Improper Input Validation

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2026-34383", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.1}]}, "published": "2026-03-31T21:16:30.343", "references": [{"url": "https://github.com/Admidio/admidio/commit/00494b95dfe847af8b938e4397e5d909d8f36839", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Admidio/admidio/security/advisories/GHSA-4rwm-c5mj-wh7x", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Admidio is an open-source user management solution. Prior to version 5.0.8, the inventory module's item_save endpoint accepts a user-controllable POST parameter imported that, when set to true, completely bypasses both CSRF token validation and server-side form validation. An authenticated user can craft a direct POST request to save arbitrary inventory item data without CSRF protection and without the field value checks that the FormPresenter validation normally enforces. This issue has been patched in version 5.0.8."}], "lastModified": "2026-04-01T18:28:06.967", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "943C8893-5336-477E-9026-C55A9659B1EA", "versionEndExcluding": "5.0.8"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}