CVE-2026-34383: CSRF in Admidio User Management

An attacker exploiting this CSRF vulnerability can trick an authenticated Admidio user into unknowingly submitting a malicious POST request to the item_save endpoint. By setting the imported parameter to true, the attacker bypasses both CSRF token validation and server-side form validation. This enables them to save arbitrary inventory item data without any checks, potentially leading to data corruption, unauthorized access, or even privilege escalation depending on the nature of the inventory data. The impact is amplified if the inventory data contains sensitive information or is used to configure critical system settings. While requiring authentication, the ease of crafting the malicious request makes this a concerning vulnerability.

1. Reserved2026-03-27
2. Published2026-03-31
3. Modified2026-04-03
4. EPSS updated2026-04-08

The primary mitigation for CVE-2026-34383 is to immediately upgrade Admidio to version 5.0.8 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. While a direct WAF rule targeting the itemsave endpoint is difficult without knowing the specific data being manipulated, implementing stricter input validation on the server-side can help reduce the attack surface. Review and restrict access to the inventory module to only authorized personnel. Monitor Admidio logs for suspicious POST requests to the itemsave endpoint, particularly those originating from unexpected sources. After upgrading, confirm the fix by attempting to submit a POST request with the imported=true parameter and verifying that the request is rejected.