CVE-2026-34382

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34382", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-27T13:43:14.370Z", "datePublished": "2026-03-31T20:32:35.032Z", "dateUpdated": "2026-04-01T18:42:45.890Z"}, "containers": {"cna": {"title": "Admidio: Missing CSRF Protection on Custom List Deletion in mylist_function.php", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/Admidio/admidio/security/advisories/GHSA-g3mx-8jm6-rc85", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-g3mx-8jm6-rc85"}, {"name": "https://github.com/Admidio/admidio/commit/317ec91ad3baf19d4179db6c32413812eb36d7ca", "tags": ["x_refsource_MISC"], "url": "https://github.com/Admidio/admidio/commit/317ec91ad3baf19d4179db6c32413812eb36d7ca"}], "affected": [{"vendor": "Admidio", "product": "admidio", "versions": [{"version": ">= 5.0.0, < 5.0.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T20:32:35.032Z"}, "descriptions": [{"lang": "en", "value": "Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, the delete mode handler in mylist_function.php permanently deletes list configurations without validating a CSRF token. An attacker who can lure an authenticated user to a malicious page can silently destroy that user's list configurations \u2014 including organization-wide shared lists when the victim holds administrator rights. This issue has been patched in version 5.0.8."}], "source": {"advisory": "GHSA-g3mx-8jm6-rc85", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T18:42:38.824506Z", "id": "CVE-2026-34382", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T18:42:45.890Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34382", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T18:42:38.824506Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T18:42:42.434Z"}}], "cna": {"title": "Admidio: Missing CSRF Protection on Custom List Deletion in mylist_function.php", "source": {"advisory": "GHSA-g3mx-8jm6-rc85", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Admidio", "product": "admidio", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.0.8"}]}], "references": [{"url": "https://github.com/Admidio/admidio/security/advisories/GHSA-g3mx-8jm6-rc85", "name": "https://github.com/Admidio/admidio/security/advisories/GHSA-g3mx-8jm6-rc85", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Admidio/admidio/commit/317ec91ad3baf19d4179db6c32413812eb36d7ca", "name": "https://github.com/Admidio/admidio/commit/317ec91ad3baf19d4179db6c32413812eb36d7ca", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, the delete mode handler in mylist_function.php permanently deletes list configurations without validating a CSRF token. An attacker who can lure an authenticated user to a malicious page can silently destroy that user's list configurations \u2014 including organization-wide shared lists when the victim holds administrator rights. This issue has been patched in version 5.0.8."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T20:32:35.032Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34382", "state": "PUBLISHED", "dateUpdated": "2026-04-01T18:42:45.890Z", "dateReserved": "2026-03-27T13:43:14.370Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-31T20:32:35.032Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "admidio", "vendor": "Admidio", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.0.8"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*", "matchCriteriaId": "57D165DA-4B63-4140-9E3E-B66F1A9CE955", "versionEndExcluding": "5.0.8", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, the delete mode handler in mylist_function.php permanently deletes list configurations without validating a CSRF token. An attacker who can lure an authenticated user to a malicious page can silently destroy that user's list configurations \u2014 including organization-wide shared lists when the victim holds administrator rights. This issue has been patched in version 5.0.8."}, {"lang": "es", "value": "Admidio es una soluci\u00f3n de gesti\u00f3n de usuarios de c\u00f3digo abierto. Desde la versi\u00f3n 5.0.0 hasta antes de la versi\u00f3n 5.0.8, el gestor del modo de eliminaci\u00f3n en mylist_function.php elimina permanentemente las configuraciones de lista sin validar un token CSRF. Un atacante que puede atraer a un usuario autenticado a una p\u00e1gina maliciosa puede destruir silenciosamente las configuraciones de lista de ese usuario - incluyendo listas compartidas a nivel de organizaci\u00f3n cuando la v\u00edctima posee derechos de administrador. Este problema ha sido parcheado en la versi\u00f3n 5.0.8."}], "id": "CVE-2026-34382", "lastModified": "2026-10-06T22:10:00.247", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34382", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-01T18:42:38.824506Z", "version": "2.0.3"}}]}, "published": "2026-03-31T21:16:30.180", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Admidio/admidio/commit/317ec91ad3baf19d4179db6c32413812eb36d7ca"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-g3mx-8jm6-rc85"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.0.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "admidio", "source": "cna", "vendor": "Admidio"}, "product": "admidio", "vendor": "admidio"}], "analysis": {"en": {"generated_at": "2026-04-02T04:54:03.561071+00:00", "value": {"mitigation_remediation": ["Update Admidio to version 5.0.8 or later to re\u2011enable CSRF protection for list deletion.", "If an upgrade cannot be applied immediately, restrict the delete endpoint to only those users who absolutely require that privilege.", "Monitor application logs for unexpected delete operations and investigate any anomalies.", "Verify that other state\u2011changing actions in the application also enforce CSRF tokens to prevent similar vulnerabilities.", "Educate users about the risks of clicking on unfamiliar links and emphasize the need to confirm the legitimacy of administrative interfaces before responding to prompts."], "summary": {"action": "Apply Patch", "impact": "Data Loss"}, "threat_synthesis": {"affected_systems": "Admidio versions 5.0.0 through 5.0.7 are affected. The issue was addressed in version 5.0.8, which restores CSRF protection for list deletion. Installations that have not applied this update remain vulnerable.", "description_and_impact": "The vulnerability resides in Admidio\u2019s mylist_function.php, where the deletion of list configurations is performed without validating a CSRF token. An attacker can cause an authenticated user to send a delete request that permanently removes the targeted list configuration. If the victim holds administrator rights, organization\u2011wide shared lists can also be destroyed, resulting in irreversible data loss that can disrupt collaboration and system configurations.", "risk_and_exploitability": "The CVSS score of 4.6 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability does not require special environmental conditions; however, the only stated prerequisite is an authenticated user visiting a malicious link. The likely attack vector is social engineering whereby an attacker lures the user to a malicious page that triggers the deletion. Since the flaw allows permanent deletion of configuration data, it poses a significant risk to data integrity for organizations that rely on shared lists. It is not listed in the CISA KEV catalog."}}}}, "created": "2026-04-02T07:52:34.610209+00:00", "updated": "2026-04-02T20:10:48.424210+00:00", "vendors": ["admidio", "admidio$PRODUCT$admidio"]}