Description

Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random password for `user_uuid_assigned`, stores its bcrypt hash in `adm_users.usr_password`, and emails the cleartext to that user. Every other state-changing mode in the same file (`assign_member`, `assign_user`, `delete_user`, `create_user`) calls `SecurityUtils::validateCsrfToken($_POST['adm_csrf_token'])` first; the `send_login` branch does not. Prior to version 5.0.10, page visited by a registration-administrator can issue the request as a top-level navigation, the browser sends the admin's `SameSite=Lax` cookies, and the server resets the chosen user's password without any further interaction from the admin. Version 5.0.10 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.2",
  "pubDate": "2026-08-12T14:17:53.750Z",
  "pubdate": "2026-08-12T14:17:53.750Z",
  "executiveSummary": "A Cross-Site Request Forgery (CSRF) vulnerability exists in Admidio prior to version 5.0.10 within the registration module.\nThe vulnerability allows an attacker to trigger the regeneration and disclosure of a user password without authorization.\nThe flaw impacts the user management solution by failing to validate Cross-Site Request Forgery tokens during the password reset workflow.\nRisk implications include unauthorized credential resets and potential account compromise for arbitrary system users.\nAn attacker must leverage a social engineering vector or malicious external site to induce a targeted administrator to issue a top-level navigation request while authenticated with SameSite=Lax session cookies.\nThe vulnerability is fully remediated in Admidio version 5.0.10 through the enforcement of proper token validation.",
  "technicalDetails": "The root cause of the vulnerability is the absence of anti-CSRF token validation within a specific state-changing operational branch.\nSpecifically, within the file modules/registration.php under the send_login mode, the application regenerates a random password for user_uuid_assigned, stores the corresponding bcrypt hash in the adm_users.usr_password database column, and transmits the cleartext password via email to the targeted user.\nWhile alternative state-changing modes within the same file—namely assign_member, assign_user, delete_user, and create_user—correctly invoke SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']) prior to executing sensitive logic, the send_login mode entirely omits this security control.\nExploitation occurs when an authenticated registration-administrator visits a malicious or attacker-controlled web page that issues a top-level navigation request targeting the vulnerable endpoint.\nBecause the browser automatically attaches valid SameSite=Lax session cookies to the top-level request, the Admidio server processes the state-changing action as an authentic administrative command.\nConsequently, the server resets the chosen user's password, invalidates the existing credentials, and emails the new cleartext password, all without any interaction or explicit consent from the administrator.\nThe vulnerable component is the registration module handling the send_login action in Admidio versions prior to 5.0.10.\nSuccessful exploitation requires the victim to be an authenticated administrative user possessing privileges to manage registrations, and the attack vector relies on standard web browser cookie transmission behavior during cross-site navigations."
}