CVE-2026-53760: Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installati

Executive brief

Admidio is a free open-source user management system for websites. A security flaw allows an attacker to trick an administrator into visiting a malicious website that silently triggers the installation, update, or removal of software plugins. If a plugin is uninstalled this way, it can lead to permanent data loss by deleting database tables without the administrator's consent.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in `modules/plugins.php` because it performs state-changing operations (install, uninstall, update) using GET requests without validating CSRF tokens. Since these operations are triggered via top-level GET navigations, modern browsers include `SameSite=Lax` session cookies, allowing a cross-origin attacker to execute these actions if an authenticated administrator visits a malicious page. The `doUninstall()` function is particularly impactful as it executes SQL scripts that include `DROP TABLE` statements. The vulnerability is rooted in the lack of `SecurityUtils::validateCsrfToken()` calls in the affected component.

Affected products

• Admidio Admidio <= 5.0.11

Timeline

• 2026-06-02: disclosed: Reported to Admidio by aisafe.io
• 2026-07-09: advisory: GitHub Advisory published

References

• https://api.github.com/users/adrgs
• https://github.com/adrgs
• https://api.github.com/users/adrgs/gists%7B/gist_id%7D
• https://api.github.com/users/adrgs/repos
• https://avatars.githubusercontent.com/u/11564377?v=4
• https://api.github.com/users/adrgs/events%7B/privacy%7D