# CVE-2026-47228: Admidio CSRF password reset in registration module

Source: https://junglewise.ai/threats/cve-2026-47228-admidio-csrf-password-reset-in-registration-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-47228 · Severity: medium · CVSS 5.2 · Published 2026-05-29

Admidio is a popular open-source user management system for organizations and groups. A security flaw allows an attacker to trick an administrator into visiting a malicious website, which then silently triggers a password reset for any user on the Admidio platform. This results in the victim being locked out of their account and receiving an unexpected password reset email, which could also be used as part of a phishing attack.

Technologies: [Admidio](https://junglewise.ai/threats/technologies/admidio), [admidio/admidio (Packagist)](https://junglewise.ai/threats/technologies/admidio-admidio). Vendors: [Admidio](https://junglewise.ai/threats/vendors/admidio), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-47228 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47228 being exploited in the wild.

**How severe is CVE-2026-47228?** Medium severity, with a CVSS score of 5.2, published 29 May 2026.

**Which products and versions are affected?** Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.

**Is there a fix for CVE-2026-47228?** Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47228 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-47228?** Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- admidio/admidio (Packagist): upgrade to 5.0.10 or later

  ```sh
  composer require admidio/admidio:^5.0.10
  ```


## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in 'modules/registration.php' within the 'send_login' mode. Unlike other state-changing modes in the same file, 'send_login' fails to validate CSRF tokens and does not enforce the POST HTTP method, allowing execution via GET requests (e.g., via an <img> tag). An attacker can craft a request that, when processed by a logged-in registration administrator, triggers 'User::sendNewPassword()'. This regenerates a random password, updates the database with a new bcrypt hash, and emails the cleartext to the victim. This leads to immediate account lockout for the victim and potential social engineering opportunities. The issue is fixed in version 5.0.10.

## Affected products

- Admidio Admidio <= 5.0.9

## Identifiers

- CVE-2026-47228
- GHSA-mx25-j3rc-6w2w

## Timeline

- 2026-05-25: disclosed
- 2026-05-29: advisory

## References

- [https://api.github.com/users/offset](https://api.github.com/users/offset)
- [https://github.com/offset](https://github.com/offset)
- [https://api.github.com/users/offset/gists%7B/gist_id%7D](https://api.github.com/users/offset/gists%7B/gist_id%7D)
- [https://api.github.com/users/offset/repos](https://api.github.com/users/offset/repos)
- [https://avatars.githubusercontent.com/u/114768995?v=4](https://avatars.githubusercontent.com/u/114768995?v=4)
- [https://api.github.com/users/offset/events%7B/privacy%7D](https://api.github.com/users/offset/events%7B/privacy%7D)

## Related threats

- [Admidio improper access control in event registration](https://junglewise.ai/threats/cve-2026-117554-admidio-before-5-0-17-contains-an-improper-access-control)
- [Admidio information disclosure in RSS weblinks feed](https://junglewise.ai/threats/cve-2026-111916-admidio-before-5-0-16-contains-an-information-disclosure)
- [Admidio broken access control in inventory module](https://junglewise.ai/threats/cve-2026-111914-admidio-from-5-0-11-before-5-0-16-contains-a-broken-access)
- [Admidio authorization bypass via pdfl export mode](https://junglewise.ai/threats/cve-2026-111913-admidio-from-5-0-0-before-5-0-16-contains-an-authorization)
- [Admidio forum topic authorization bypass in ForumService::saveTopic()](https://junglewise.ai/threats/cve-2026-111912-admidio-from-5-0-0-before-5-0-16-contains-an-insecure-direct)