Executive brief
Admidio is an open-source platform used by organizations to manage user memberships and lists. A security flaw allows an attacker to trick a logged-in user into clicking a malicious link that silently deletes their saved list configurations. If the victim is an administrator, this can result in the permanent deletion of organization-wide shared lists, such as contact and membership directories, with no built-in way to recover the data.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Admidio's 'mylist_function.php' component. While the application implements CSRF token validation for 'save' operations, the 'delete' mode handler lacks this check, allowing destructive actions to be triggered via unauthorized POST requests. An attacker can exploit this by luring an authenticated user with list-editing permissions to a malicious website that submits a hidden form to the vulnerable endpoint. Successful exploitation results in the permanent deletion of list configurations from the 'adm_lists' table; if the victim has administrative privileges, global organization lists are affected. The vulnerability is addressed in version 5.0.8 by enforcing CSRF token validation across all destructive modes.
Affected products
- Admidio Admidio >= 5.0.0, < 5.0.8
Timeline
- 2026-03-27: advisory: Vendor advisory published on GitHub
- 2026-03-31: disclosed: CVE published to NVD
- 2026-03-31: patched: Fix released in version 5.0.8