CVE-2026-32816: CSRF in admidio/admidio

An attacker can exploit this CSRF vulnerability by crafting a malicious HTML page containing a forged POST request. If a user with the rol_as role visits this page while authenticated in admidio, the attacker can trigger actions such as deleting, activating, or deactivating organizational roles. The attacker only needs to discover a role UUID, which is potentially visible in the public cards view if the module is publicly accessible. Successful exploitation could result in unauthorized modifications to user permissions and access controls, potentially compromising the integrity of the admidio system.

1. Reserved2026-03-16
2. Published2026-03-16
3. Modified2026-03-20
4. EPSS updated2026-03-27

The primary mitigation for CVE-2026-32816 is to upgrade admidio/admidio to version 5.0.7 or later, which includes the necessary CSRF token validation. If upgrading immediately is not feasible, consider implementing a Web Application Firewall (WAF) rule to block suspicious POST requests targeting the vulnerable endpoints (modules/groups-roles/groups_roles.php). Carefully review user access controls and ensure the cards view is not publicly accessible if it exposes role UUIDs. After upgrading, confirm the fix by attempting to trigger the vulnerable actions with a forged POST request and verifying that the action is blocked.