CVE-2026-47232: Admidio PKCS#12 Private Key Export Lacks CSRF Protection
Summary
CVE-2026-47232: Admidio PKCS#12 private key export action lacks CSRF protection. Affects admidio/admidio versions < 5.0.10. Fixed in 5.0.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Admidio is an open-source application designed for managing memberships and events. It provides features such as user authentication, event scheduling, and secure storage of sensitive information like keys and certificates. The application is widely used by organizations to streamline their administrative processes. However, a critical vulnerability has been identified in version 5.0.9, which compromises the security of private key exports.
Vulnerability Detail
The vulnerability arises from the absence of Cross-Site Request Forgery (CSRF) protection in the sensitive 'mode=export' action located in modules/sso/keys.php. The CSRF validation line is commented out, allowing an attacker to exploit this by sending a forged cross-site POST request from an authenticated administrator's session. This can lead to unauthorized export of the PKCS#12 bundle containing private keys and certificates, posing a significant security risk.
How To Fix
Minimum fixed version
5.0.10
This is the first release that contains the fix.
composer require admidio/admidio:5.0.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually validate CSRF tokens in your application until the package is updated. Uncomment the CSRF validation line in the export action code to prevent unauthorized exports. The code should look like this:
case 'export':
SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']);
$keyService = new KeyService($gDb);
$password = admFuncVariableIsValid($_POST, 'key_password', 'string');
$keyService->exportToPkcs12($getKeyUUID, $password);
break;
Conclusion
The CVE-2026-47232 vulnerability in Admidio poses a serious risk by allowing unauthorized export of private keys due to insufficient CSRF protection. It is crucial to update to the patched version 5.0.10 or later to mitigate this risk. Implementing the suggested workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for admidio/admidio →
FAQ
CVE-2026-47232 is a vulnerability in Admidio that allows unauthorized export of private keys due to a lack of CSRF protection.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can lead to unauthorized access to sensitive private key material, which could compromise the security of the application and its users.
Yes, a patch is available in version 5.0.10 of Admidio, which restores CSRF protection.
If you cannot update immediately, ensure to implement the CSRF validation manually as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for admidio/admidio.
