Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-53760: Admidio can be tricked into installing or deleting plugins

CVE-2026-53760 · published 2 months ago

Summary

Versions of Admidio up through 5.0.11 allow plugin changes to happen simply by visiting a web address. If an administrator clicks a malicious link, the system can install, update, or remove plugins, and removing a plugin can delete its data. Updating to the newest Admidio version adds a required confirmation step and stops this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
composer	admidio	admidio	<= 5.0.11
–	admidio	admidio	< 056b1bd9f995437395e337d2c73a32e5c96ee616

Original advisory text

Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests

Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include SameSite=Lax session cookies. An attacker crafts a malicious page that, when an authenticated administrator visits it, triggers arbitrary plugin operations. The uninstall operation executes DROP TABLE SQL scripts and destroys plugin data. This issue has been patched via commit 056b1bd.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53760... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-53760 Vendor Advisory
https://github.com/advisories/GHSA-hm42-q32m-vj4f
https://github.com/Admidio/admidio/commit/056b1bd9f995437395e337d2c73a32e5c96ee6... Patch
https://github.com/Admidio/admidio/security/advisories/GHSA-hm42-q32m-vj4f Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.2 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-352Cross-Site Request Forgery (CSRF)

Timeline

Published4 Sep 2026

Updated4 Nov 2026

First seen9 Jul 2026

Sources

GHSA-hm42-q32m-vj4f · GHSA

CVE-2026-53760 · NVD

CVE-2026-53760 · MITRE

CVE-2026-53760 · OSV

Track software like this

Free during beta