CVE-2026-69093

EUVD-2026-52286
Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters (delete and copy). An attacker can trick an authenticated administrator into visiting a crafted URL to delete or duplicate Category Report configurations, affecting the integrity and availability of that module's configuration.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
4.6 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 5.48%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
admidioadmidio
𝑥
< 5.0.11
CNA
Common Weakness Enumeration
References
https://github.com/Admidio/admidio/commit/e1fe6fd2fcafb6a65a550760f79447abdef31461
https://github.com/Admidio/admidio/security/advisories/GHSA-mvx3-m6p6-7r9w
https://www.vulncheck.com/advisories/admidio-before-csrf-via-category-report-preferences
https://github.com/Admidio/admidio/security/advisories/GHSA-mvx3-m6p6-7r9w