CVE-2026-109328 Admidio CVE debrief

Who should care

Defenders responsible for Admidio installations, administrators managing user registrations, and security teams focused on web application vulnerabilities should assess exposure and prioritize remediation.

Why it matters

CVE-2026-109328 is a MEDIUM-severity vulnerability in Admidio that allows unauthenticated stored XSS attacks via registration name inputs. Defenders should prioritize verifying and updating Admidio installations, reviewing registration inputs, and enhancing monitoring to mitigate potential risks.

• Potential for unauthorized actions or data manipulation through injected malicious scripts.
• Risk of XSS attacks leading to session hijacking or unauthorized changes.
• Need for verification of Admidio version and exposure to potential attacks.
• Priority for enhancing monitoring and incident response for web application attacks.

Technical summary

The vulnerability exists in the RegistrationPresenter.php file of Admidio, where the FIRST_NAME registration value is inserted into an unencoded data-message attribute. This allows attackers to register with a malicious name that contains a double-quoted event handler, which executes JavaScript when an administrator hovers over the entry on the Manage registrations page. The vulnerability affects Admidio versions 5.0.0 before 5.0.15, and defenders should prioritize verifying and updating Admidio installations to version 5.0.15 or later. Additionally, reviewing registration inputs for suspicious patterns and enhancing monitoring for unusual administrator actions can help mitigate potential risks.

Defensive priority

Defenders should prioritize verifying and updating Admidio installations to version 5.0.15 or later, reviewing registration inputs for suspicious patterns, and enhancing monitoring for unusual administrator actions.

Recommended defensive actions

• Verify and update Admidio installations to version 5.0.15 or later.
• Review registration inputs for suspicious patterns.
• Enhance monitoring for unusual administrator actions on the Manage registrations page.
• Consider implementing additional security measures for user input validation and sanitization.
• Confirm whether affected Admidio product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in Admidio versions before 5.0.15 and the potential for unauthenticated stored XSS attacks. However, specific instances of exploitation or detailed impact assessments are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.