Is CVE-2026-34384 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34384 being exploited in the wild.

How severe is CVE-2026-34384?

Medium severity, with a CVSS score of 4.5, published 31 March 2026.

Which products and versions are affected?

Admidio < 5.0.8; admidio/admidio (Packagist) ECOSYSTEM:introduced=0,fixed=5.0.8.

Is there a fix for CVE-2026-34384?

Yes. admidio/admidio (Packagist): upgrade to 5.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34384 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-34384?

Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34384: Admidio CSRF in registration approval actions

Q: Which products and versions are affected?

Admidio < 5.0.8; admidio/admidio (Packagist) ECOSYSTEM:introduced=0,fixed=5.0.8.

Q: Is there a fix for CVE-2026-34384?

Yes. admidio/admidio (Packagist): upgrade to 5.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-34384 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-34384?

Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34384 · Severity: medium · CVSS 4.5 · Published 2026-03-31

Admidio is an open-source platform used by organizations to manage member registrations and profiles. A security flaw allows attackers to bypass the manual approval process for new accounts by tricking an administrator into clicking a malicious link or visiting a compromised webpage. This could allow unauthorized individuals to gain access to private member data or, in some cases, take over existing member accounts.

Technologies: Admidio, admidio/admidio (Packagist). Vendors: Admidio, Packagist.

Quick answers

Is CVE-2026-34384 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34384 being exploited in the wild.
How severe is CVE-2026-34384?: Medium severity, with a CVSS score of 4.5, published 31 March 2026.
Which products and versions are affected?: Admidio < 5.0.8; admidio/admidio (Packagist) ECOSYSTEM:introduced=0,fixed=5.0.8.
Is there a fix for CVE-2026-34384?: Yes. admidio/admidio (Packagist): upgrade to 5.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34384 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34384?: Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

admidio/admidio (Packagist): upgrade to 5.0.8 or later
```
composer require admidio/admidio:^5.0.8
```

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in Admidio's registration module. The 'create_user', 'assign_member', and 'assign_user' action modes in modules/registration.php process state-changing requests via GET parameters without validating a CSRF token. An attacker can extract their own registration UUID from a confirmation email and craft a malicious URL. If a user with 'rol_approve_users' privileges is enticed to visit this URL (e.g., via an <img> tag), the attacker's registration is automatically approved. Furthermore, the 'assign_user' mode can be abused to merge a pending registration into an existing account, leading to account takeover if the target's UUID is known. The issue is fixed in version 5.0.8 by requiring POST requests and valid CSRF tokens for these actions.

Affected products

Admidio Admidio < 5.0.8

Identifiers

CVE-2026-34384
GHSA-ph84-r98x-2j22

Timeline

2026-03-27: advisory: GitHub Security Advisory published
2026-03-31: disclosed: NVD publication date
2026-03-31: patched: Fix released in version 5.0.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.