---
id: CVE-2026-47228
title: Admidio is an open-source user management solution
summary: >-
  Admidio is an open-source user management solution. `modules/registration.php`
  mode `send_login` regenerates a random password for `user_uuid_assigned`,
  stores its bcrypt hash in `adm_users.usr_password`, and emails the cleartext
  to that…
severity: medium
cvss: 5.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L'
cwe:
  - CWE-352
published: '2026-08-12'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:55:04.493'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-47228'
references:
  - url: 'https://github.com/Admidio/admidio/security/advisories/GHSA-mx25-j3rc-6w2w'
    label: security-advisories@github.com
  - url: 'https://github.com/Admidio/admidio/security/advisories/GHSA-mx25-j3rc-6w2w'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00161
epssPercentile: 0.04532
ingestedAt: '2026-09-09T21:22:45.530Z'
---

## Overview

Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random password for `user_uuid_assigned`, stores its bcrypt hash in `adm_users.usr_password`, and emails the cleartext to that user. Every other state-changing mode in the same file (`assign_member`, `assign_user`, `delete_user`, `create_user`) calls `SecurityUtils::validateCsrfToken($_POST['adm_csrf_token'])` first; the `send_login` branch does not. Prior to version 5.0.10, page visited by a registration-administrator can issue the request as a top-level navigation, the browser sends the admin's `SameSite=Lax` cookies, and the server resets the chosen user's password without any further interaction from the admin. Version 5.0.10 fixes the issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.