CVE-2026-34383

MEDIUM

4.3

Descripcion

Admidio is an open-source user management solution. Prior to version 5.0.8, the inventory module's item_save endpoint accepts a user-controllable POST parameter imported that, when set to true, completely bypasses both CSRF token validation and server-side form validation. An authenticated user can craft a direct POST request to save arbitrary inventory item data without CSRF protection and without the field value checks that the FormPresenter validation normally enforces. This issue has been patched in version 5.0.8.

Detalles CVE

Puntuacion CVSS v3.14.3

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado3/31/2026

Ultima modificacion4/1/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

admidio:admidio

Debilidades (CWE)

CWE-20CWE-352

Referencias

https://github.com/Admidio/admidio/commit/00494b95dfe847af8b938e4397e5d909d8f36839(security-advisories@github.com)

https://github.com/Admidio/admidio/security/advisories/GHSA-4rwm-c5mj-wh7x(security-advisories@github.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.