Admidio: Absence de protection CSRF sur les actions d'approbation de l'inscription

The primary impact of this CSRF vulnerability lies in the ability of an attacker to bypass the intended registration process and create new user accounts within the Admidio system. By crafting malicious links or requests, an attacker can trick a legitimate user into approving a registration request they did not initiate. This can lead to the creation of unauthorized accounts with potentially elevated privileges, depending on the Admidio configuration. The attacker could leverage these accounts for malicious purposes, such as data theft, system compromise, or further attacks within the network. The lack of CSRF protection on the approval actions (createuser, assignmember, assign_user) makes this vulnerability particularly concerning.

Organizations using Admidio for user management, particularly those running versions prior to 5.0.8, are at risk. Shared hosting environments where multiple users share the same Admidio instance are especially vulnerable, as an attacker could potentially compromise accounts belonging to other users.

• php / server:

find /var/www/html/admidio -name 'modules/registration.php' -print0 | xargs -0 grep -i 'approve.*GET'

• generic web:

curl -I https://your-admidio-domain.com/modules/registration.php?approve=YOUR_UUID

Inspect the response headers for any unexpected behavior or error messages. • php / server:

journalctl -u php-fpm | grep -i 'registration.php'

Review PHP-FPM logs for suspicious requests to the registration.php endpoint.

1. 2026-03-31Disclosure

   disclosure

1. Réservé2026-03-27
2. Publiée2026-03-31
3. Modifiée2026-04-01
4. EPSS mis à jour2026-04-08

The recommended mitigation for CVE-2026-34384 is to immediately upgrade Admidio to version 5.0.8 or later, which includes the necessary CSRF protection. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests to the /modules/registration.php endpoint with the approve parameter in the GET request. Additionally, review and restrict access to the Admidio installation to minimize the potential attack surface. After upgrading, confirm the fix by attempting to trigger a registration approval via a crafted URL and verifying that the action is blocked or requires proper authentication.