CVE-2026-34384

CVE-2026-34384 is a medium-severity vulnerability in Admidio with a CVSS 3.x base score of 4.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-352.

Key facts

Description

Admidio is an open-source user management solution. Prior to version 5.0.8, the create_user, assign_member, and assign_user action modes in modules/registration.php approve pending user registrations via GET request without validating a CSRF token. Unlike the delete_user mode in the same file (which correctly validates the token), these three approval actions read their parameters from $_GET and perform irreversible state changes without any protection. An attacker who has submitted a pending registration can extract their own user UUID from the registration confirmation email URL, then trick any user with the rol_approve_users right into visiting a crafted URL that automatically approves the registration. This bypasses the manual registration approval workflow entirely. This issue has been patched in version 5.0.8.

Frequently asked questions

What is CVE-2026-34384?
Admidio is an open-source user management solution. Prior to version 5.0.8, the create_user, assign_member, and assign_user action modes in modules/registration.php approve pending user registrations via GET request without validating a CSRF token. Unlike the delete_user mode in the same file (which correctly validates the token), these three approval actions read their parameters from $_GET and perform irreversible state changes without any protection. An attacker who has submitted a pending registration can extract their own user UUID from the registration confirmation email URL, then trick any user with the rol_approve_users right into visiting a crafted URL that automatically approves the registration. This bypasses the manual registration approval workflow entirely. This issue has been patched in version 5.0.8.
How severe is CVE-2026-34384?
CVE-2026-34384 has a CVSS 3.x base score of 4.5, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2026-34384 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-34384?
CVE-2026-34384 affects Admidio. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-34384?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-34384 have an EU (EUVD) identifier?
Yes. CVE-2026-34384 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-17628.
When was CVE-2026-34384 published?
CVE-2026-34384 was published on 2026-03-31 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Admidio

All CVEs affecting Admidio →

Other CWE-352 (Cross-Site Request Forgery (CSRF)) vulnerabilities

Browse all CWE-352 (Cross-Site Request Forgery (CSRF)) vulnerabilities →