Admidioにおいて、mylist_function.phpのカスタムリスト削除にCSRF保護が欠如している

The primary impact of CVE-2026-34382 is the unauthorized deletion of admidio list configurations. An attacker can craft a malicious page that, when visited by an authenticated admidio user, triggers the deletion of these configurations. This is particularly concerning for users with administrator rights, as they can inadvertently delete organization-wide shared lists, disrupting workflows and potentially causing data loss. The attack relies on social engineering to lure the victim to the malicious page, making user awareness a crucial factor in mitigating the risk. The scope of the impact depends on the permissions of the compromised user; an administrator's actions could affect a much larger group.

Organizations using admidio, particularly those with shared list configurations managed by administrators, are at risk. Environments with limited security awareness training or those relying on default admidio configurations are especially vulnerable. Shared hosting environments where multiple users share the same admidio instance also face increased risk.

• php: Examine admidio logs for unusual deletion events, particularly those originating from unexpected IP addresses. • generic web: Monitor access logs for requests to modules/groups-roles/mylist_function.php with suspicious parameters. • generic web: Use a web application firewall (WAF) to detect and block requests lacking a valid CSRF token for sensitive actions.

1. 2026-03-31Disclosure

   disclosure

1. 予約済み2026-03-27
2. 公開日2026-03-31
3. 更新日2026-04-06
4. EPSS 更新日2026-04-08

The recommended mitigation for CVE-2026-34382 is to immediately upgrade admidio to version 5.0.8 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing temporary workarounds. While a direct WAF rule to block CSRF attacks is generally applicable, it's less effective here due to the reliance on user interaction. Review admidio's configuration to ensure the principle of least privilege is enforced, limiting the potential impact of a compromised administrator account. Monitor admidio logs for suspicious deletion activity. After upgrading, confirm the fix by attempting to trigger a list deletion via a crafted CSRF request and verifying that the action is blocked.

最終更新

345ヶ月前