p PatchFirst

CVE-2026-47229

CVE-2026-47229 · Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/sso/clients.php` validates an `adm_csrf_token` on every state-changing branch except `enable`. The `enable` case loads the SAML or OIDC client by UUID, calls `$client->enable($enabled)`, and persists the new state with no token check. Because the action is reachable via plain GET parameters, a third-party page can trick an authenticated administrator into disabling (or silently re-enabling) any configured SAML or OIDC client. Disabling an SSO client breaks every downstream relying-party application that authenticates through it. Version 5.0.10 contains a fix.

CVSS 5.4 · Medium · EPSS 0.1% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • admidio

    Versions
    • < 5.0.10: Affected

    No fix published

  • admidio/admidio Packagist

    Versions
    • 4.1.0
    • 4.1.3
    • v4.2-Beta.1
    • v4.2-Beta.2
    • v4.2-Beta.3
    • v4.2.0
    • v4.2.1
    • v4.2.10
    • v4.2.11
    • v4.2.12
    • v4.2.13
    • v4.2.14
    • v4.2.2
    • v4.2.3
    • v4.2.4
    • v4.2.5
    • v4.2.6
    • v4.2.7
    • v4.2.8
    • v4.2.9
    • v4.3-Beta.1
    • v4.3-Beta.3
    • v4.3-Beta.4
    • v4.3-Beta.5
    • v4.3.0
    • v4.3.1
    • v4.3.10
    • v4.3.11
    • v4.3.12
    • v4.3.13
    • v4.3.14
    • v4.3.15
    • v4.3.16
    • v4.3.17
    • v4.3.2
    • v4.3.3
    • v4.3.4
    • v4.3.5
    • v4.3.6
    • v4.3.7
    • v4.3.8
    • v4.3.9
    • v5.0-Beta.1
    • v5.0-Beta.2
    • v5.0-Beta.3
    • v5.0.0
    • v5.0.1
    • v5.0.2
    • v5.0.3
    • v5.0.4
    • v5.0.5
    • v5.0.6
    • v5.0.7
    • v5.0.8
    • v5.0.9
    Affected ranges
    • ECOSYSTEM: < 5.0.10

    Update to 5.0.10

Original sources

Check your server →