CVE-2026-47229 Admidio CVE debrief

Who should care

Administrators of Admidio installations should be aware of this vulnerability and take steps to verify their version and apply the fix. They should also review and update configurations for SAML and OIDC clients, and monitor for potential suspicious activity related to SSO clients. Additionally, security teams and vulnerability management teams should prioritize verifying their version and applying the fix to prevent potential exploitation.

Why it matters

CVE-2026-47229 is a vulnerability in Admidio that allows an attacker to trick an authenticated administrator into disabling or re-enabling any configured SAML or OIDC client, potentially disrupting downstream applications and requiring verification and fix application.

• Potential disruption to downstream relying-party applications that authenticate through SSO clients.
• Possible unauthorized changes to SSO client configurations.
• Need for verification of Admidio version and application of the fix.
• Potential for exploitation via plain GET parameters.

Technical summary

The vulnerability is caused by the lack of `adm_csrf_token` validation on the `enable` branch in `modules/sso/clients.php`. This allows an attacker to trick an authenticated administrator into disabling or re-enabling any configured SAML or OIDC client, potentially disrupting downstream applications. The issue affects Admidio installations prior to version 5.0.10. The vulnerability can be exploited via plain GET parameters, and its exploitation could lead to disruption of downstream relying-party applications that authenticate through SSO clients.

Defensive priority

Administrators of Admidio installations should prioritize verifying their version and applying the fix to prevent potential exploitation.

Recommended defensive actions

• Verify Admidio version and apply the fix to prevent potential exploitation.
• Review and update configurations for SAML and OIDC clients.
• Monitor for potential suspicious activity related to SSO clients.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score. The GitHub security advisory provides additional context on the issue. To verify, defenders should check the Admidio version and apply the fix. The vulnerability affects Admidio installations prior to version 5.0.10, and its exploitation could lead to disruption of downstream relying-party applications. Evidence is limited to public sources, and further verification is required.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.