CVE-2026-32816

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32816", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-16T17:35:36.696Z", "datePublished": "2026-03-19T22:57:19.068Z", "dateUpdated": "2026-03-20T17:29:42.359Z"}, "containers": {"cna": {"title": "Admidio has Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Admidio/admidio/security/advisories/GHSA-wwg8-6ffr-h4q2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-wwg8-6ffr-h4q2"}, {"name": "https://github.com/Admidio/admidio/releases/tag/v5.0.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/Admidio/admidio/releases/tag/v5.0.7"}], "affected": [{"vendor": "Admidio", "product": "admidio", "versions": [{"version": ">= 5.0.0, < 5.0.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-19T22:57:19.068Z"}, "descriptions": [{"lang": "en", "value": "Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the delete, activate, and deactivate modes in modules/groups-roles/groups_roles.php perform destructive state changes on organizational roles but never validate an anti-CSRF token. The client-side UI passes a CSRF token to callUrlHideElement(), which includes it in the POST body, but the server-side handlers ignore $_POST[\"adm_csrf_token\"] entirely for these three modes. An attacker who can discover a role UUID (visible in the public cards view when the module is publicly accessible) can embed a forged POST form on any external page and trick any user with the rol_assign_roles right into deleting or toggling roles for the organization. Role deletion is permanent and cascades to all memberships, event associations, and rights data. If exploited, an attacker can trick any user with delegated role-assignment rights into permanently deleting roles, mass-revoking all associated memberships and access to events, documents, and mailing lists, or silently activating or deactivating entire groups, with target role UUIDs trivially harvested from the unauthenticated public cards view and no undo path short of a database restore. This issue has been fixed in version 5.0.7."}], "source": {"advisory": "GHSA-wwg8-6ffr-h4q2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-20T17:26:42.937028Z", "id": "CVE-2026-32816", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T17:29:42.359Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Admidio has Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions", "source": {"advisory": "GHSA-wwg8-6ffr-h4q2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Admidio", "product": "admidio", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.0.7"}]}], "references": [{"url": "https://github.com/Admidio/admidio/security/advisories/GHSA-wwg8-6ffr-h4q2", "name": "https://github.com/Admidio/admidio/security/advisories/GHSA-wwg8-6ffr-h4q2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Admidio/admidio/releases/tag/v5.0.7", "name": "https://github.com/Admidio/admidio/releases/tag/v5.0.7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the delete, activate, and deactivate modes in modules/groups-roles/groups_roles.php perform destructive state changes on organizational roles but never validate an anti-CSRF token. The client-side UI passes a CSRF token to callUrlHideElement(), which includes it in the POST body, but the server-side handlers ignore $_POST[\"adm_csrf_token\"] entirely for these three modes. An attacker who can discover a role UUID (visible in the public cards view when the module is publicly accessible) can embed a forged POST form on any external page and trick any user with the rol_assign_roles right into deleting or toggling roles for the organization. Role deletion is permanent and cascades to all memberships, event associations, and rights data. If exploited, an attacker can trick any user with delegated role-assignment rights into permanently deleting roles, mass-revoking all associated memberships and access to events, documents, and mailing lists, or silently activating or deactivating entire groups, with target role UUIDs trivially harvested from the unauthenticated public cards view and no undo path short of a database restore. This issue has been fixed in version 5.0.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-19T22:57:19.068Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32816", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-20T17:26:42.937028Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-20T17:29:28.902Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-32816", "state": "PUBLISHED", "dateUpdated": "2026-03-19T22:57:19.068Z", "dateReserved": "2026-03-16T17:35:36.696Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-19T22:57:19.068Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "admidio", "vendor": "Admidio", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.0.7"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*", "matchCriteriaId": "4020E2FE-8E51-405F-86CB-DAAFBA7FD9B3", "versionEndExcluding": "5.0.7", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the delete, activate, and deactivate modes in modules/groups-roles/groups_roles.php perform destructive state changes on organizational roles but never validate an anti-CSRF token. The client-side UI passes a CSRF token to callUrlHideElement(), which includes it in the POST body, but the server-side handlers ignore $_POST[\"adm_csrf_token\"] entirely for these three modes. An attacker who can discover a role UUID (visible in the public cards view when the module is publicly accessible) can embed a forged POST form on any external page and trick any user with the rol_assign_roles right into deleting or toggling roles for the organization. Role deletion is permanent and cascades to all memberships, event associations, and rights data. If exploited, an attacker can trick any user with delegated role-assignment rights into permanently deleting roles, mass-revoking all associated memberships and access to events, documents, and mailing lists, or silently activating or deactivating entire groups, with target role UUIDs trivially harvested from the unauthenticated public cards view and no undo path short of a database restore. This issue has been fixed in version 5.0.7."}, {"lang": "es", "value": "Admidio es una soluci\u00f3n de gesti\u00f3n de usuarios de c\u00f3digo abierto. En las versiones 5.0.0 a 5.0.6, los modos de eliminar, activar y desactivar en modules/groups-roles/groups_roles.php realizan cambios de estado destructivos en los roles organizacionales, pero nunca validan un token anti-CSRF. La interfaz de usuario del cliente (UI) pasa un token CSRF a callUrlHideElement(), que lo incluye en el cuerpo de la solicitud POST, pero los manejadores del servidor ignoran $_POST[\"adm_csrf_token\"] por completo para estos tres modos. Un atacante que pueda descubrir un UUID de rol (visible en la vista p\u00fablica de tarjetas cuando el m\u00f3dulo es accesible p\u00fablicamente) puede incrustar un formulario POST falsificado en cualquier p\u00e1gina externa y enga\u00f1ar a cualquier usuario con el derecho rol_assign_roles para que elimine o alterne roles para la organizaci\u00f3n. La eliminaci\u00f3n de roles es permanente y se propaga a todas las membres\u00edas, asociaciones de eventos y datos de derechos. Si se explota, un atacante puede enga\u00f1ar a cualquier usuario con derechos delegados de asignaci\u00f3n de roles para que elimine roles de forma permanente, revoque masivamente todas las membres\u00edas asociadas y el acceso a eventos, documentos y listas de correo, o active o desactive silenciosamente grupos enteros, con los UUID de rol objetivo f\u00e1cilmente obtenidos de la vista p\u00fablica de tarjetas no autenticada y sin una ruta de deshacer que no sea una restauraci\u00f3n de la base de datos. Este problema ha sido solucionado en la versi\u00f3n 5.0.7."}], "id": "CVE-2026-32816", "lastModified": "2026-06-17T10:36:24.003", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32816", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-20T17:26:42.937028Z", "version": "2.0.3"}}]}, "published": "2026-03-19T23:16:44.380", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/Admidio/admidio/releases/tag/v5.0.7"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-wwg8-6ffr-h4q2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.0.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "admidio", "source": "cna", "vendor": "Admidio"}, "product": "admidio", "vendor": "admidio"}], "analysis": {"en": {"generated_at": "2026-03-23T20:40:55.979671+00:00", "value": {"mitigation_remediation": ["Upgrade Admidio to version 5.0.7 or later, which implements CSRF validation for role delete, activate, and deactivate actions. ", "Review the application\u2019s role management pages to confirm that all state\u2011changing operations now require a valid CSRF token. ", "Limit the \"rol_assign_roles\" privilege to trusted users and consider disabling public view of role identifiers to reduce discoverability of role UUIDs. ", "Enable logging for role modification events and regularly audit logs for unexpected changes. ", "If an upgrade cannot be performed promptly, isolate the affected module by restricting external access or disabling role modification endpoints until a patch is applied."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized deletion or toggling of organizational roles by users with assignment rights"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Admidio open\u2011source user management application under the vendor name Admidio, specifically versions 5.0.0 through 5.0.6. The issue was resolved in the subsequent release, Admidio 5.0.7, which adds proper CSRF validation to the affected operations. Users of the older releases are directly exposed to the risk unless they apply the patch.", "description_and_impact": "Admidio versions 5.0.0 through 5.0.6 allow role deletion, activation, and deactivation actions to be performed without validating a CSRF token. The server-side code accepts POST requests for these operations, ignoring the submitted CSRF value, while the client interface includes one. An attacker who knows a role UUID, which is exposed in public cards when the module is accessible, can craft a forged POST form on an external page and trick any user who holds the \"rol_assign_roles\" permission into executing destructive changes. Role deletion is irreversible and cascades to all related memberships, event associations, and rights data, leading to widespread loss of access to documents, mailing lists, and event participation. Since there is no undo capability beyond a database restore, the impact is severe for organizational integrity and data availability.", "risk_and_exploitability": "The CVSS score of 5.7 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA\u2019s KEV catalog. Successful exploitation requires that an attacker first identify a valid role UUID\u2014which can be harvested from the public module view\u2014and then persuade the user with \"rol_assign_roles\" rights to submit a forged form. The attack vector is web\u2011based, and no authentication bypass is necessary; however, the necessity of a privileged account reduces the overall risk exposure to organizations that strictly limit that role. Given the irreversible effects of role deletion, the potential damage warrants immediate action."}}}}, "created": "2026-03-20T08:54:30.514762+00:00", "updated": "2026-03-25T11:54:10.972685+00:00", "vendors": ["admidio", "admidio$PRODUCT$admidio"]}