{"id":"CVE-2026-34382","title":"Admidio is an open-source user management solution","summary":"Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, the delete mode handler in mylist_function.php permanently deletes list configurations without validating a CSRF token. An attacker who can l…","severity":"medium","cvss":4.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","cwe":["CWE-352"],"vendor":"admidio","product":"admidio","affected":["admidio >= 5.0.0, < 5.0.8"],"patched":["admidio 5.0.8"],"published":"2026-03-31","updated":"2026-10-06","sourceUpdated":"2026-10-06T22:10:00.247","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34382","references":[{"url":"https://github.com/Admidio/admidio/commit/317ec91ad3baf19d4179db6c32413812eb36d7ca","label":"security-advisories@github.com"},{"url":"https://github.com/Admidio/admidio/security/advisories/GHSA-g3mx-8jm6-rc85","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.0014,"epssPercentile":0.02825,"ingestedAt":"2026-10-06T22:23:15.911Z","slug":"CVE-2026-34382","body":"## Overview\n\nAdmidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, the delete mode handler in mylist_function.php permanently deletes list configurations without validating a CSRF token. An attacker who can lure an authenticated user to a malicious page can silently destroy that user's list configurations — including organization-wide shared lists when the victim holds administrator rights. This issue has been patched in version 5.0.8.\n\n## Affected\n\n- `admidio >= 5.0.0, < 5.0.8`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `admidio 5.0.8`","depth":"sunlit","depthScore":25,"depthScoreParts":{"impact":25.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}