Cloudanix VulnDB

GHSA-wwg8-6ffr-h4q2

Medium · 5.7

Admidio is Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions

CVSS

5.7

EPSS

—

Published

Mar 16, 2026

CISA due date

—

The record

The `delete`, `activate`, and `deactivate` modes in `modules/groups-roles/groups_roles.php` perform destructive state changes on organizational roles but never validate an anti-CSRF token. The client-side UI passes a CSRF token to `callUrlHideElement()`, which includes it in the POST body, but the server-side handlers ignore `$_POST["adm_csrf_token"]` entirely for these three modes. An attacker who can discover a role UUID (visible in the public `cards` view when the module is publicly accessible) can embed a forged POST form on any external page and trick any user with the `rol_assign_roles` right into deleting or toggling roles for the organization. Role deletion is permanent and cascades to all memberships, event associations, and rights data.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities