Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-53760— Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests

Quick assessment

Affected
Admidio admidio
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Admidio 是一个开源的用户管理解决方案。在 5.0.11 及更早版本中，modules/plugins.php 端点通过 GET 请求处理插件的安装、卸载和更新操作，且未进行 CSRF 令牌验证。由于这些操作属于顶级导航，浏览器会携带 SameSite=Lax 属性的会话 Cookie 发起请求。攻击者可构造一个恶意网页，当已认证的管理员访问该页面时，即可触发任意的插件操作。其中，卸载操作会执行 SQL 脚本，从而销毁插件数据。该问题已在提交 056b1bd 中修复。

CVSS 5.2 · Medium EPSS 0.01% · P2

Affected Version Matrix 1

VendorProduct Version RangeStatus
Admidio admidio < 056b1bd9f995437395e337d2c73a32e5c96ee616 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53760

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests
Source: CVE Program / CVE List V5
Vulnerability Description
Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include SameSite=Lax session cookies. An attacker crafts a malicious page that, when an authenticated administrator visits it, triggers arbitrary plugin operations. The uninstall operation executes DROP TABLE SQL scripts and destroys plugin data. This issue has been patched via commit 056b1bd.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Admidio admidio < 056b1bd9f995437395e337d2c73a32e5c96ee616 -

II. Public POCs for CVE-2026-53760

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53760

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-53760 (1)

Vendor Advisories for CVE-2026-53760 (1)

IV. Related Vulnerabilities

Same product: admidio
Same vendor: Admidio
Same weakness: CWE-352

V. Comments for CVE-2026-53760

No comments yet

Leave a comment