{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34382", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-27T13:43:14.370Z", "datePublished": "2026-03-31T20:32:35.032Z", "dateUpdated": "2026-04-01T18:42:45.890Z"}, "containers": {"cna": {"title": "Admidio: Missing CSRF Protection on Custom List Deletion in mylist_function.php", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/Admidio/admidio/security/advisories/GHSA-g3mx-8jm6-rc85", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-g3mx-8jm6-rc85"}, {"name": "https://github.com/Admidio/admidio/commit/317ec91ad3baf19d4179db6c32413812eb36d7ca", "tags": ["x_refsource_MISC"], "url": "https://github.com/Admidio/admidio/commit/317ec91ad3baf19d4179db6c32413812eb36d7ca"}], "affected": [{"vendor": "Admidio", "product": "admidio", "versions": [{"version": ">= 5.0.0, < 5.0.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T20:32:35.032Z"}, "descriptions": [{"lang": "en", "value": "Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, the delete mode handler in mylist_function.php permanently deletes list configurations without validating a CSRF token. An attacker who can lure an authenticated user to a malicious page can silently destroy that user's list configurations \u2014 including organization-wide shared lists when the victim holds administrator rights. This issue has been patched in version 5.0.8."}], "source": {"advisory": "GHSA-g3mx-8jm6-rc85", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T18:42:38.824506Z", "id": "CVE-2026-34382", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T18:42:45.890Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34382", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T18:42:38.824506Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T18:42:42.434Z"}}], "cna": {"title": "Admidio: Missing CSRF Protection on Custom List Deletion in mylist_function.php", "source": {"advisory": "GHSA-g3mx-8jm6-rc85", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Admidio", "product": "admidio", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.0.8"}]}], "references": [{"url": "https://github.com/Admidio/admidio/security/advisories/GHSA-g3mx-8jm6-rc85", "name": "https://github.com/Admidio/admidio/security/advisories/GHSA-g3mx-8jm6-rc85", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Admidio/admidio/commit/317ec91ad3baf19d4179db6c32413812eb36d7ca", "name": "https://github.com/Admidio/admidio/commit/317ec91ad3baf19d4179db6c32413812eb36d7ca", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, the delete mode handler in mylist_function.php permanently deletes list configurations without validating a CSRF token. An attacker who can lure an authenticated user to a malicious page can silently destroy that user's list configurations \u2014 including organization-wide shared lists when the victim holds administrator rights. This issue has been patched in version 5.0.8."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T20:32:35.032Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34382", "state": "PUBLISHED", "dateUpdated": "2026-04-01T18:42:45.890Z", "dateReserved": "2026-03-27T13:43:14.370Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-31T20:32:35.032Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*", "matchCriteriaId": "57D165DA-4B63-4140-9E3E-B66F1A9CE955", "versionEndExcluding": "5.0.8", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, the delete mode handler in mylist_function.php permanently deletes list configurations without validating a CSRF token. An attacker who can lure an authenticated user to a malicious page can silently destroy that user's list configurations \u2014 including organization-wide shared lists when the victim holds administrator rights. This issue has been patched in version 5.0.8."}], "id": "CVE-2026-34382", "lastModified": "2026-04-01T18:25:24.703", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-03-31T21:16:30.180", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Admidio/admidio/commit/317ec91ad3baf19d4179db6c32413812eb36d7ca"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-g3mx-8jm6-rc85"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.0.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "admidio", "source": "cna", "vendor": "Admidio"}, "product": "admidio", "vendor": "admidio"}], "analysis": {"en": {"generated_at": "2026-04-02T04:54:03.561071+00:00", "value": {"mitigation_remediation": ["Update Admidio to version 5.0.8 or later to re\u2011enable CSRF protection for list deletion.", "If an upgrade cannot be applied immediately, restrict the delete endpoint to only those users who absolutely require that privilege.", "Monitor application logs for unexpected delete operations and investigate any anomalies.", "Verify that other state\u2011changing actions in the application also enforce CSRF tokens to prevent similar vulnerabilities.", "Educate users about the risks of clicking on unfamiliar links and emphasize the need to confirm the legitimacy of administrative interfaces before responding to prompts."], "summary": {"action": "Apply Patch", "impact": "Data Loss"}, "threat_synthesis": {"affected_systems": "Admidio versions 5.0.0 through 5.0.7 are affected. The issue was addressed in version 5.0.8, which restores CSRF protection for list deletion. Installations that have not applied this update remain vulnerable.", "description_and_impact": "The vulnerability resides in Admidio\u2019s mylist_function.php, where the deletion of list configurations is performed without validating a CSRF token. An attacker can cause an authenticated user to send a delete request that permanently removes the targeted list configuration. If the victim holds administrator rights, organization\u2011wide shared lists can also be destroyed, resulting in irreversible data loss that can disrupt collaboration and system configurations.", "risk_and_exploitability": "The CVSS score of 4.6 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability does not require special environmental conditions; however, the only stated prerequisite is an authenticated user visiting a malicious link. The likely attack vector is social engineering whereby an attacker lures the user to a malicious page that triggers the deletion. Since the flaw allows permanent deletion of configuration data, it poses a significant risk to data integrity for organizations that rely on shared lists. It is not listed in the CISA KEV catalog."}}}}, "created": "2026-04-02T07:52:34.610209+00:00", "updated": "2026-04-02T20:10:48.424210+00:00", "vendors": ["admidio", "admidio$PRODUCT$admidio"]}