CVE-2026-47232 PUBLISHED

Admidio PKCS#12 private key export action lacks CSRF protection

Assigner: GitHub_M
Reserved: 18.05.2026 Published: 12.08.2026 Updated: 12.08.2026

Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive mode=export action in modules/sso/keys.php exports a PKCS#12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an administrator session can therefore trigger private key export without a valid form token. Version 5.0.10 contains a fix.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS Score: 4.3

Product Status

Vendor Admidio
Product admidio
Versions
  • Version < 5.0.10 is affected

References

Problem Types

  • CWE-352: Cross-Site Request Forgery (CSRF) CWE