CVE-2026-34382 json
Admidio: Missing CSRF Protection on Custom List Deletion in mylist_function.php
published 2026-03-31 7 mo ago modified 2026-10-06 33 d ago also EUVD-2026-17624 , GHSA-g3mx-8jm6-rc85
- cvss
- 4.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 2%
- public exploits
- 0
- none known
Summary
Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, the delete mode handler in mylist_function.php permanently deletes list configurations without validating a CSRF token. An attacker who can lure an authenticated user to a malicious page can silently destroy that user's list configurations — including organization-wide shared lists when the victim holds administrator rights. This issue has been patched in version 5.0.8.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/Admidio/admidio/security/advisories/GHSA-g3mx-8jm6-rc85 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L |
| GitHub | 3.1 | 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | admidio/admidio | >=5.0.0, <5.0.8 |
5.0.8 |
Affected products
- Admidio admidio
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
References
-
github.com
/Admidio/admidio/commit/317ec91ad3baf19d4179db6c32413812eb36d7ca
web, patch
-
github.com
/Admidio/admidio/security/advisories/GHSA-g3mx-8jm6-rc85
web, exploit, mitigation, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-34382
advisory
-
github.com
/Admidio/admidio
package
Sources
- CVE List CVE-2026-34382
- GitHub Advisory GHSA-g3mx-8jm6-rc85
- NVD CVE-2026-34382
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.