3.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41663

CVE-2026-41663: Admidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email Send

Admidio is an open-source user management solution. Prior to version 5.0.9, several administrative operations in Admidio's preferences module (database backup, test email, htaccess generation) fire via GET requests with no CSRF token validation. Because SameSite=Lax cookies travel with top-level GET navigations, an attacker forces an authenticated admin to trigger these actions from a malicious page. This issue has been patched in version 5.0.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41663

CVE-2026-41663:

3.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
admidio/admidio	composer	<= 5.0.8	5.0.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic Cross-Site Request Forgery (CSRF) where administrative actions are triggered by GET requests without any CSRF protection. The analysis of the patch identified the exact locations where this vulnerability was fixed. The core of the vulnerability lies in modules/preferences.php, which handles the backend logic for actions like database backup, sending test emails, and modifying the .htaccess file. The patch clearly shows the addition of CSRF token validation in this script for the 'backup', 'test_email', 'htaccess', and 'update_check' modes. Additionally, the frontend code, specifically in the PreferencesPresenter class, was modified to change the requests from GET to POST and include the CSRF token. The functions PreferencesPresenter->createEmailDispatchForm and PreferencesPresenter->show were identified as responsible for generating the vulnerable UI elements (links and AJAX calls) that initiated the unprotected GET requests. Therefore, these functions would appear in a runtime profile when the vulnerable parts of the UI are rendered and interacted with, and preferences.php would be the script executing the unauthorized commands on the server.

Vulnerable functions

preferences.php

modules/preferences.php

This script is the entry point for several administrative actions. The 'htaccess', 'test_email', 'backup', and 'update_check' actions were handled via GET requests without any CSRF token validation. This allowed an attacker to trick an administrator into executing these actions by visiting a malicious URL. The patch adds CSRF token validation for these actions, requiring them to be POST requests.

PreferencesPresenter->createEmailDispatchForm

src/UI/Presenter/PreferencesPresenter.php

This function was responsible for generating a link that triggered the 'test_email' action. The link was a simple `<a>` tag with an `href` attribute, which results in a GET request. An attacker could use this to create a CSRF attack. The patch changes this to an `onclick` event that triggers a POST request with a CSRF token.

PreferencesPresenter->show

src/UI/Presenter/PreferencesPresenter.php

This function generated JavaScript code that made AJAX requests to perform 'update_check' and 'htaccess' actions. These requests were made using `$.get`, which is vulnerable to CSRF. The patch changes these to `$.post` requests and includes a CSRF token.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.