CVE-2026-53760: Admidio Plugin Management CSRF Vulnerability
Summary
CVE-2026-53760: Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests. Affects admidio/admidio versions < 5.0.11. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Admidio is an open-source software designed for managing clubs and organizations. It provides functionalities for user management, event scheduling, and plugin support to enhance its capabilities. However, a critical vulnerability has been identified in the plugin management system, specifically in the handling of plugin installation, uninstallation, and updates, which exposes the application to Cross-Site Request Forgery (CSRF) attacks.
Vulnerability Detail
The vulnerability arises from the modules/plugins.php endpoint, which processes plugin operations via GET requests without validating CSRF tokens. This oversight allows an attacker to craft a malicious page that, when visited by an authenticated administrator, can trigger arbitrary plugin actions such as installation, uninstallation, or updates. The most severe consequence is the uninstallation operation, which executes SQL scripts that can drop database tables, leading to irreversible data loss. The lack of CSRF protection makes it easy for attackers to exploit this vulnerability through social engineering tactics, tricking administrators into visiting harmful links.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, administrators can avoid using the plugin management features until the vulnerability is patched. Additionally, ensure that only trusted users have access to the administrative interface to mitigate the risk of exploitation.
Conclusion
The CSRF vulnerability in Admidio's plugin management system poses a significant risk to administrators, allowing attackers to perform malicious actions without consent. It is crucial to update to the latest version and implement necessary security measures to protect against such exploits.
See every vulnerability recorded for admidio/admidio →
FAQ
Cross-Site Request Forgery (CSRF) is a type of attack that tricks a user into executing unwanted actions on a web application in which they are authenticated.
You can check your application for vulnerabilities using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without needing to sign up.
An attacker can perform unauthorized actions such as uninstalling plugins, which may lead to data loss or disruption of service.
Yes, updating to the latest version of Admidio will provide a fix for this vulnerability.
Immediately review your logs for unauthorized actions, change passwords, and update to the latest version of Admidio to secure your installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for admidio/admidio.
