Is CVE-2026-47232 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47232 being exploited in the wild.

How severe is CVE-2026-47232?

Medium severity, with a CVSS score of 4.3, published 29 May 2026.

Which products and versions are affected?

Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.

Is there a fix for CVE-2026-47232?

Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47232 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-47232?

Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47232: Admidio CSRF in PKCS#12 private key export

Q: Which products and versions are affected?

Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.

Q: Is there a fix for CVE-2026-47232?

Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47232 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-47232?

Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47232 · Severity: medium · CVSS 4.3 · Published 2026-05-29

Admidio is a web-based user management system. A security flaw in its single sign-on (SSO) component allows an attacker to trick an administrator into exporting sensitive private key files. If an administrator visits a malicious website while logged in, the attacker can trigger a download of the organization's private security keys, potentially compromising secure communications.

Technologies: Admidio, admidio/admidio (Packagist). Vendors: Admidio, Packagist.

Quick answers

Is CVE-2026-47232 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47232 being exploited in the wild.
How severe is CVE-2026-47232?: Medium severity, with a CVSS score of 4.3, published 29 May 2026.
Which products and versions are affected?: Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.
Is there a fix for CVE-2026-47232?: Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47232 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-47232?: Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

admidio/admidio (Packagist): upgrade to 5.0.10 or later
```
composer require admidio/admidio:^5.0.10
```

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in Admidio's SSO key management module. Specifically, the 'mode=export' action in 'modules/sso/keys.php' has its CSRF validation logic commented out in the source code. This allows a remote attacker to craft a malicious webpage that, when visited by an authenticated administrator, triggers a POST request to export a PKCS#12 bundle containing the configured private key and certificate. While the Same-Origin Policy (SOP) typically prevents the attacker from reading the downloaded file directly, the lack of protection allows for the unauthorized execution of a highly sensitive administrative action. The issue is fixed in version 5.0.10.

Affected products

Admidio Admidio <= 5.0.9

Identifiers

CVE-2026-47232
GHSA-4rgq-38mh-9xqg

Timeline

2026-05-25: disclosed
2026-05-29: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.