CVE-2026-34384 Admidio CVE debrief

Who should care

Users of Admidio user management solution, particularly those with the rol_approve_users right, should be aware of this vulnerability and take steps to upgrade to version 5.0.8 or later. Additionally, users should be cautious when clicking on links from untrusted sources.

Technical summary

The vulnerability exists in the modules/registration.php file, specifically in the create_user, assign_member, and assign_user action modes. These modes approve pending user registrations via GET request without validating a CSRF token, unlike the delete_user mode which correctly validates the token. An attacker can exploit this by extracting their own user UUID from the registration confirmation email URL and crafting a URL that automatically approves the registration when visited by a user with the rol_approve_users right.

Defensive priority

High

Recommended defensive actions

• Upgrade to Admidio version 5.0.8 or later
• Implement CSRF token validation for create_user, assign_member, and assign_user action modes
• Restrict access to the rol_approve_users right
• Monitor for suspicious activity related to user registration and approval
• Perform a thorough review of user registration and approval workflows to identify potential vulnerabilities
• Verify that all user accounts with the rol_approve_users right have been properly configured and are being actively monitored
• Conduct regular security audits to detect and address potential issues with user registration and approval processes

Evidence notes

The CVE record was published on 2026-03-31T21:16:30.503Z and was last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. The vulnerability has a CVSS score of 4.5 and a severity of MEDIUM.

Official resources