CVE-2026-34382: CSRF in admidio/admidio

The primary impact of CVE-2026-34382 is the unauthorized deletion of admidio list configurations. An attacker can craft a malicious page that, when visited by an authenticated admidio user, triggers the deletion of these configurations. This is particularly concerning for users with administrator rights, as they can inadvertently delete organization-wide shared lists, disrupting workflows and potentially causing data loss. The attack relies on social engineering to lure the victim to the malicious page, making user awareness a crucial factor in mitigating the risk. The scope of the impact depends on the permissions of the compromised user; an administrator's actions could affect a much larger group.

1. Reserved2026-03-27
2. Published2026-03-31
3. Modified2026-04-06
4. EPSS updated2026-04-08

The recommended mitigation for CVE-2026-34382 is to immediately upgrade admidio to version 5.0.8 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing temporary workarounds. While a direct WAF rule to block CSRF attacks is generally applicable, it's less effective here due to the reliance on user interaction. Review admidio's configuration to ensure the principle of least privilege is enforced, limiting the potential impact of a compromised administrator account. Monitor admidio logs for suspicious deletion activity. After upgrading, confirm the fix by attempting to trigger a list deletion via a crafted CSRF request and verifying that the action is blocked.

Last updated

345 months ago