CVE-2026-53760

    Dashboard / Vulnerabilities / CVE-2026-53760

    CVE-2026-53760

    Published: 4 Sept 2026Last Modified: 11 Sept 2026

    Summary: Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests

    Details: Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include SameSite=Lax session cookies. An attacker crafts a malicious page that, when an authenticated administrator visits it, triggers arbitrary plugin operations. The uninstall operation executes DROP TABLE SQL scripts and destroys plugin data. This issue has been patched via commit 056b1bd.

    References: https://github.com/Admidio/admidio/security/advisories/GHSA-hm42-q32m-vj4f, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53760.json, https://nvd.nist.gov/vuln/detail/CVE-2026-53760, https://github.com/Admidio/admidio/commit/056b1bd9f995437395e337d2c73a32e5c96ee616

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -056b1bd9f995437395e337d2c73a32e5c96ee616

    Affected versions

    v5.0-Beta.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-53760 | CVE-DB