CVE-2026-47232 MEDIUM

CVE-2026-47232: Admidio PKCS#12 private key export action lacks CSRF protection

Vendor Admidio

Product admidio

Weakness CWE-352 · CSRF

Published August 12, 2026

Last update August 12, 2026

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive `mode=export` action in `modules/sso/keys.php` exports a PKCS#12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an administrator session can therefore trigger private key export without a valid form token. Version 5.0.10 contains a fix.

Key dates

02Disclosure timeline

August 12, 2026 CVE published

August 12, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-47232 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html AskarLabs — CWE-352 write-up Cross-Site Request Forgery

Related vulnerabilities

04Related CVE

CVE-2026-4275 Divi Torque Lite <= 4.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Installation via 'install_plugin' REST Endpoint CVE-2026-63684 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension CVE-2026-57786 WordPress WorkScout-Core plugin <= 1.7.08 - Cross Site Request Forgery (CSRF) to Broken Authentication vulnerability CVE-2026-57747 WordPress Booked plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-60025 Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0