5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47229

CVE-2026-47229: Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation

Summary

modules/sso/clients.php validates an adm_csrf_token on every state-changing branch except enable. The enable case loads the SAML or OIDC client by UUID, calls $client->enable($enabled), and persists the new state with no token check. Because the action is reachable via plain GET parameters, a third-party page can trick an authenticated administrator into disabling (or silently re-enabling) any configured SAML or OIDC client. Disabling an SSO client breaks every downstream relying-party application that authenticates through it.

Details

Vulnerable Code

modules/sso/clients.php:84-115 — the file's other branches each begin with SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']);, but case 'enable': does not:

case 'delete_oidc':
    // check the CSRF token of the form against the session token
    SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']);

    $oidcService = new OIDCService($gDb, $gCurrentUser);
    $client = $oidcService->getClientFromUUID($getClientUUID);
    $client->delete();
    echo json_encode(array('status' => 'success'));
    break;

case 'enable':                                          // <- no CSRF validation
    $enabled = admFuncVariableIsValid($_GET, 'enabled', 'boolean');
    $client = new SAMLClient($gDb);
    $client->readDataByUuid($getClientUUID);
    if ($client->isNewRecord()) {
        // Not a SAML record, so try OIDC:
        $client = new OIDCClient($gDb);
        $client->readDataByUuid($getClientUUID);
    }
    if ($client->isNewRecord()) {
        throw new Exception('SYS_SSO_INVALID_CLIENT');
    }
    $client->enable($enabled);
    $client->save();
    echo json_encode(['success' => true]);
    break;

The enable($enabled) call is documented to set a single boolean column on the SAML / OIDC client row — smc_enabled for SAML, ocl_enabled for OIDC — and save() persists the change immediately. The handler accepts plain GET (admFuncVariableIsValid($_GET, 'enabled', 'boolean')), so a or auto-submitting form is sufficient.

Miggo Vulnerability Database

→

CVE-2026-47229

CVE-2026-47229:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
admidio/admidio	composer	<= 5.0.9	5.0.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic Cross-Site Request Forgery (CSRF) in the Admidio application, specifically within the SSO client management functionality. The root cause is the lack of a CSRF token check in the case 'enable': block of the modules/sso/clients.php script. While other actions in the same script correctly validate a CSRF token, the 'enable' action did not, and it accepted parameters from $_GET. This allowed an attacker to craft a malicious URL (e.g., in an <img> tag) which, when visited by a logged-in administrator, would change the status of an SSO client without the administrator's knowledge or consent.

The exploitation of this vulnerability would cause the enable method of either the SAMLClient or OIDCClient class to be called, followed by save(), persisting the state change in the database. Therefore, the execution of modules/sso/clients.php and the subsequent calls to SAMLClient::enable or OIDCClient::enable are the primary indicators of this vulnerability being triggered.

The patch addresses this by enforcing a POST request and validating a CSRF token for the 'enable' action, which is the correct mitigation for CSRF vulnerabilities.

Vulnerable functions

modules/sso/clients.php

modules/sso/clients.php

This script is the entry point for the vulnerable action. The 'enable' mode was handled via a GET request without any CSRF token validation. This allowed an attacker to trick an authenticated administrator into making a request that disables or enables an SSO client without their consent. The vulnerability lies in the 'enable' case of the switch statement within this file.

SAMLClient::enable

modules/sso/clients.php

This method is called within the vulnerable request handler in 'modules/sso/clients.php' to change the enabled status of a SAML client. It is part of the vulnerable execution flow that leads to the state change, and would appear in a profiler trace during exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.