Is CVE-2026-47228 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47228 being exploited in the wild.

How severe is CVE-2026-47228?

Medium severity, with a CVSS score of 5.2, published 29 May 2026.

Which products and versions are affected?

Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.

Is there a fix for CVE-2026-47228?

Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47228 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-47228?

Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47228: Admidio CSRF password reset in registration module

Q: Which products and versions are affected?

Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.

Q: Is there a fix for CVE-2026-47228?

Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47228 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-47228?

Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47228 · Severity: medium · CVSS 5.2 · Published 2026-05-29

Admidio is a popular open-source user management system for organizations and groups. A security flaw allows an attacker to trick an administrator into visiting a malicious website, which then silently triggers a password reset for any user on the Admidio platform. This results in the victim being locked out of their account and receiving an unexpected password reset email, which could also be used as part of a phishing attack.

Technologies: Admidio, admidio/admidio (Packagist). Vendors: Admidio, Packagist.

Quick answers

Is CVE-2026-47228 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47228 being exploited in the wild.
How severe is CVE-2026-47228?: Medium severity, with a CVSS score of 5.2, published 29 May 2026.
Which products and versions are affected?: Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.
Is there a fix for CVE-2026-47228?: Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47228 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-47228?: Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

admidio/admidio (Packagist): upgrade to 5.0.10 or later
```
composer require admidio/admidio:^5.0.10
```

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in 'modules/registration.php' within the 'send_login' mode. Unlike other state-changing modes in the same file, 'send_login' fails to validate CSRF tokens and does not enforce the POST HTTP method, allowing execution via GET requests (e.g., via an <img> tag). An attacker can craft a request that, when processed by a logged-in registration administrator, triggers 'User::sendNewPassword()'. This regenerates a random password, updates the database with a new bcrypt hash, and emails the cleartext to the victim. This leads to immediate account lockout for the victim and potential social engineering opportunities. The issue is fixed in version 5.0.10.

Affected products

Admidio Admidio <= 5.0.9

Identifiers

CVE-2026-47228
GHSA-mx25-j3rc-6w2w

Timeline

2026-05-25: disclosed
2026-05-29: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.