Admidio está sem proteção CSRF em alterações de datas de associação de função

The core impact of CVE-2026-32755 lies in the potential for unauthorized modification of user roles within an Admidio deployment. An attacker could embed a malicious POST form on a website or email, tricking a role leader into clicking a link or visiting the page. This crafted form would then silently submit a request to Admidio, altering the membership dates of users. This could lead to privilege escalation, denial of access for legitimate users, or other disruptive actions depending on the roles involved. The visibility of membership UUIDs in the HTML source code facilitates this attack, making exploitation relatively straightforward for an attacker with basic web development skills.

Organizations using Admidio for user management, particularly those with role-based access control, are at risk. Deployments with a large number of users and frequent role changes are especially vulnerable. Shared hosting environments where multiple users share the same Admidio instance also face increased risk, as an attacker could potentially exploit the vulnerability to affect other users.

• php: Examine Admidio's modules/profile/profilefunction.php file for the absence of CSRF token validation on the savemembership handler. Search for instances of save_membership without corresponding CSRF token checks.

grep -r 'save_membership' /path/to/admidio/modules/profile/profile_function.php | grep -v 'CSRF_TOKEN'

• generic web: Monitor access logs for POST requests to /admidio/modules/profile/profile_function.php with suspicious parameters related to membership dates and UUIDs. • generic web: Check response headers for unexpected changes in user roles or membership status after a user visits a potentially malicious page.

1. 2026-03-19Disclosure

   disclosure

1. Reservado2026-03-13
2. Publicada2026-03-19
3. Modificada2026-03-25
4. EPSS atualizado2026-03-27

The primary mitigation for CVE-2026-32755 is to immediately upgrade Admidio to version 5.0.7 or later, which includes the necessary CSRF token validation. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter out POST requests to the savemembership endpoint that lack a valid CSRF token. Additionally, educate users about the risks of clicking suspicious links or visiting untrusted websites. Regularly review Admidio's configuration and ensure that user permissions are appropriately restricted to minimize the potential impact of a successful attack. After upgrade, confirm by attempting to submit a crafted POST request to the savemembership endpoint and verifying that the request is rejected due to CSRF token validation.