Is CVE-2026-47229 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47229 being exploited in the wild.

How severe is CVE-2026-47229?

Medium severity, with a CVSS score of 5.4, published 29 May 2026.

Which products and versions are affected?

Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.

Is there a fix for CVE-2026-47229?

Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47229 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-47229?

Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47229: Admidio CSRF in SSO client enable action

Q: Which products and versions are affected?

Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.

Q: Is there a fix for CVE-2026-47229?

Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47229 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-47229?

Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47229 · Severity: medium · CVSS 5.4 · Published 2026-05-29

Admidio is a web-based user management system. A security flaw allows an attacker to trick an administrator into visiting a malicious website that silently disables or re-enables Single Sign-On (SSO) connections. This can cause a service outage where users are unable to log in to connected applications, or it could re-enable insecure connections that were previously deactivated by staff.

Technologies: Admidio, admidio/admidio (Packagist). Vendors: Admidio, Packagist.

Quick answers

Is CVE-2026-47229 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47229 being exploited in the wild.
How severe is CVE-2026-47229?: Medium severity, with a CVSS score of 5.4, published 29 May 2026.
Which products and versions are affected?: Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.
Is there a fix for CVE-2026-47229?: Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47229 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-47229?: Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

admidio/admidio (Packagist): upgrade to 5.0.10 or later
```
composer require admidio/admidio:^5.0.10
```

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in `modules/sso/clients.php` within the `enable` action. While other state-changing branches in this file validate an `adm_csrf_token`, the `enable` branch fails to do so and incorrectly processes state changes via GET requests. An attacker can craft a malicious URL or hidden image tag targeting an authenticated administrator to toggle the `smc_enabled` (SAML) or `ocl_enabled` (OIDC) flags for specific client UUIDs. This can be used to disable active SSO providers, causing a denial-of-service for users relying on those providers, or to re-enable providers that were intentionally deactivated. The vulnerability is patched in version 5.0.10.

Affected products

Admidio Admidio <= 5.0.9

Identifiers

CVE-2026-47229
GHSA-xg76-5qj2-2hhv

Timeline

2026-05-25: disclosed
2026-05-29: advisory: GHSA-xg76-5qj2-2hhv published
2026-05-29: patched: Fixed in version 5.0.10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.