CVE-2026-47228: Admidio CSRF password reset in registration module

Executive brief

Admidio is a popular open-source user management system for organizations and groups. A security flaw allows an attacker to trick an administrator into visiting a malicious website, which then silently triggers a password reset for any user on the Admidio platform. This results in the victim being locked out of their account and receiving an unexpected password reset email, which could also be used as part of a phishing attack.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in 'modules/registration.php' within the 'send_login' mode. Unlike other state-changing modes in the same file, 'send_login' fails to validate CSRF tokens and does not enforce the POST HTTP method, allowing execution via GET requests (e.g., via an <img> tag). An attacker can craft a request that, when processed by a logged-in registration administrator, triggers 'User::sendNewPassword()'. This regenerates a random password, updates the database with a new bcrypt hash, and emails the cleartext to the victim. This leads to immediate account lockout for the victim and potential social engineering opportunities. The issue is fixed in version 5.0.10.

Affected products

• Admidio Admidio <= 5.0.9

Timeline

• 2026-05-25: disclosed
• 2026-05-29: advisory

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D