4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47232

CVE-2026-47232: Admidio PKCS#12 private key export action lacks CSRF protection

Summary

The sensitive mode=export action in modules/sso/keys.php exports a PKCS#12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an administrator session can therefore trigger private key export without a valid form token.

Vulnerable Code Links

https://github.com/Admidio/admidio/blob/v5.0.9/modules/sso/keys.php#L83-L94
https://github.com/Admidio/admidio/blob/v5.0.9/src/SSO/Service/KeyService.php#L108-L150

Vulnerable Code

// modules/sso/keys.php
case 'export':
// SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']);
$keyService = new KeyService($gDb);
$password = admFuncVariableIsValid($_POST, 'key_password', 'string');
$keyService->exportToPkcs12($getKeyUUID, $password);
break;

// src/SSO/Service/KeyService.php
public function exportToPkcs12(string $keyUUID, string $password = '') {
$ssoKey = new Key($this->db);
$ssoKey->readDataByUuid($keyUUID);
...
openssl_pkcs12_export($certificate, $pkcs12, $privateKey, $password, ["friendly_name" => $name]);
header('Content-Type: application/x-pkcs12');
header('Content-Disposition: attachment; filename="' . $filename . '.p12"');
echo $pkcs12;
exit;
}

What Does The Code Mean

The export route accepts a key UUID and export password from the request, then returns a PKCS#12 bundle containing the private key material and certificate as a direct browser download.

Why The Code Is Vulnerable

The route is a sensitive action and should require a valid anti-CSRF token. Because the validation call is commented out, any attacker-controlled page can force an authenticated administrator’s browser to perform the export request.

Verification Environment

Application: Admidio v5.0.9
Runtime: Dockerized Admidio + MariaDB on http://localhost:18080
Validation mode: real deployed application, not isolated unit tests

Steps To Reproduce

Miggo Vulnerability Database

→

CVE-2026-47232

CVE-2026-47232:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
admidio/admidio	composer	<= 5.0.9	5.0.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The root cause of the vulnerability is a missing CSRF check in modules/sso/keys.php for the mode=export action. The vulnerable code snippet clearly shows the validateCsrfToken call is commented out. This allows an attacker to trick an authenticated administrator into exporting a sensitive PKCS#12 key bundle via a forged cross-site POST request. The keys.php script is the initial point of vulnerability, and it subsequently calls Admidio\SSO\Service\KeyService::exportToPkcs12 to perform the key export. Therefore, both are critical to the exploit chain and would appear in a runtime profile of the attack.

Vulnerable functions

keys.php

modules/sso/keys.php

This file is the entry point for the vulnerable action. It receives the request and, due to the commented-out CSRF validation, forwards it to the KeyService for processing without proper security checks. An attacker can trigger this by sending a POST request to `/modules/sso/keys.php?mode=export`.

Admidio\SSO\Service\KeyService::exportToPkcs12

src/SSO/Service/KeyService.php

This function is responsible for exporting the sensitive private key material. Although the function itself is not the source of the CSRF vulnerability, it is the function that performs the sensitive action that the CSRF attack triggers. It reads the key data and uses `openssl_pkcs12_export` to create the bundle, which is then sent to the user.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

4.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-47232: Admidio PKCS#12 private key export action lacks CSRF protection

Summary

Vulnerable Code Links

Vulnerable Code

What Does The Code Mean

Why The Code Is Vulnerable

Verification Environment

Steps To Reproduce

CVE-2026-47232:

4.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

4.3

4.3

CVE-2026-47232: Admidio PKCS#12 private key export action lacks CSRF protection

Summary

Vulnerable Code Links

Vulnerable Code

What Does The Code Mean

Why The Code Is Vulnerable

Verification Environment

Steps To Reproduce

PoC Script

PoC Output

Impact

Remediation And Suggestions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI