{
  "affected": [
    {
      "affectedData": [
        {
          "product": "admidio",
          "vendor": "Admidio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.8"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "943C8893-5336-477E-9026-C55A9659B1EA",
              "versionEndExcluding": "5.0.8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Admidio is an open-source user management solution. Prior to version 5.0.8, the create_user, assign_member, and assign_user action modes in modules/registration.php approve pending user registrations via GET request without validating a CSRF token. Unlike the delete_user mode in the same file (which correctly validates the token), these three approval actions read their parameters from $_GET and perform irreversible state changes without any protection. An attacker who has submitted a pending registration can extract their own user UUID from the registration confirmation email URL, then trick any user with the rol_approve_users right into visiting a crafted URL that automatically approves the registration. This bypasses the manual registration approval workflow entirely. This issue has been patched in version 5.0.8."
    }
  ],
  "id": "CVE-2026-34384",
  "lastModified": "2026-06-17T10:38:59.243",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-34384",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-01T15:48:30.626509Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-03-31T21:16:30.503",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/Admidio/admidio/commit/707171c188b3e8f36007fc3f2bccbfac896ed019"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-ph84-r98x-2j22"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-ph84-r98x-2j22"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "admidio/admidio"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34384"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-31T23:11:24Z",
    "nvd_published_at": "2026-03-31T21:16:30Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe create_user, assign_member, and assign_user action modes in modules/registration.php approve pending user registrations via GET request without validating a CSRF token. Unlike the delete_user mode in the same file (which correctly validates the token), these three approval actions read their parameters from $_GET and perform irreversible state changes without any protection. An attacker who has submitted a pending registration can extract their own user UUID from the registration confirmation email URL, then trick any user with the rol_approve_users right into visiting a crafted URL that automatically approves the registration. This bypasses the manual registration approval workflow entirely.\n\n## Details\n\n### CSRF Protection Is Present for delete_user but Absent for Approval Modes\n\nFile: modules/registration.php, lines 90-128\n\nThe delete_user mode validates the CSRF token (line 99), but the three approval modes do not:\n\n```php\n// assign_member and assign_user: no CSRF check\n} elseif (in_array($getMode, array(\u0027assign_member\u0027, \u0027assign_user\u0027))) {\n    $registrationService = new RegistrationService($gDb, $getUserUUID);\n    $message = $registrationService-\u003eassignRegistration($getUserUUIDAssigned, $getMode === \u0027assign_member\u0027);\n    $gMessage-\u003esetForwardUrl($message[\u0027forwardUrl\u0027]);\n    $gMessage-\u003eshow($message[\u0027message\u0027]);\n\n// create_user: no CSRF check\n} elseif ($getMode === \u0027create_user\u0027) {\n    $registrationUser-\u003eacceptRegistration();\n    if ($gCurrentUser-\u003eisAdministratorRoles()) {\n        admRedirect(SecurityUtils::encodeUrl(ADMIDIO_URL . FOLDER_MODULES.\u0027/profile/roles.php\u0027,\n            array(\u0027accept_registration\u0027 =\u003e true, \u0027user_uuid\u0027 =\u003e $getUserUUID)));\n    }\n\n// delete_user: CSRF IS validated\n} elseif ($getMode === \u0027delete_user\u0027) {\n    SecurityUtils::validateCsrfToken($_POST[\u0027adm_csrf_token\u0027]); // \u003c-- protected\n    $registrationUser-\u003edelete();\n}\n```\n\nThe three approval modes read both UUIDs exclusively from $_GET (lines 41-43):\n\nThe approve action modes accept $_GET parameters `user_uuid` and `user_uuid_assigned` without any POST body or CSRF token. Both parameters pass through `admFuncVariableIsValid()` with `uuid` type validation, which prevents SQL injection but provides no CSRF protection.\n\n### User UUID Is Known to the Attacker from Registration Email\n\nFile: `D:/bugcrowd/admidio/repo/src/Infrastructure/Service/RegistrationService.php`, lines 154-157\n\nWhen a user submits a registration, Admidio sends a confirmation email containing a URL of the form:\n\n```\nhttps://TARGET/adm_program/modules/registration.php?id=VALIDATION_ID\u0026user_uuid=REGISTRANT_UUID\n```\n\nThe `user_uuid` in this URL is the registrant\u0027s own UUID. The attacker has this UUID because they received the confirmation email for their own registration.\n\n### isAdministratorRegistration() Is a Delegated Right\n\nFile: `D:/bugcrowd/admidio/repo/src/Users/Entity/User.php`, lines 1603-1606\n\n```php\npublic function isAdministratorRegistration(): bool\n{\n    return $this-\u003echeckRolesRight(\u0027rol_approve_users\u0027);\n}\n```\n\nThe `rol_approve_users` right is a delegated organizational privilege, not full system administrator access. Any member designated to review registrations -- for example, a membership secretary or club administrator -- is a valid CSRF victim.\n\n## PoC\n\n**Scenario: Attacker bypasses manual registration approval**\n\nPrerequisites: (1) Manual registration approval is enabled. (2) The attacker submits a registration form and receives a confirmation email with their `user_uuid`. (3) After clicking the confirmation link, their registration enters the pending queue.\n\n**Step 1: Attacker extracts their own user_uuid from the registration email**\n\nThe confirmation email contains a link of the form:\n\n```\nhttps://TARGET/adm_program/modules/registration.php?id=VALIDATION_ID\u0026user_uuid=ATTACKER_UUID\n```\n\nThe `ATTACKER_UUID` is visible to the attacker from their own email.\n\n**Step 2: CSRF auto-approval via image tag**\n\nThe attacker hosts a page that the victim (admin with `rol_approve_users` right) visits:\n\n```html\n\u003cimg src=\"https://TARGET/adm_program/modules/registration.php?mode=create_user\u0026user_uuid=ATTACKER_UUID\" width=\"1\" height=\"1\"\u003e\n```\n\nWhen the victim loads this page, Admidio silently accepts the attacker registration and assigns default organization roles. No confirmation or token is required.\n\n**Step 3: Force-assign registration to an existing account (account takeover)**\n\nIf the attacker knows the UUID of an existing member (obtainable from profile page URLs when the user list is visible) and has a pending registration:\n\n```html\n\u003cimg src=\"https://TARGET/adm_program/modules/registration.php?mode=assign_user\u0026user_uuid=ATTACKER_REG_UUID\u0026user_uuid_assigned=EXISTING_USER_UUID\" width=\"1\" height=\"1\"\u003e\n```\n\nThis merges the pending registration into the existing account, replacing that account login credentials with the attacker credentials.\n\n## Impact\n\n- **Manual Approval Bypass:** An attacker with a pending registration can force auto-approval without waiting for an administrator to manually review it. This grants them organization membership, including access to events, documents, mailing lists, and other role-restricted features.\n- **Account Takeover via assign_user CSRF:** If the attacker knows any member UUID (visible in profile page URLs), the `assign_user` mode merges the attacker registration into that member account, replacing the existing member login with the attacker credentials. This is a full account takeover requiring only that the victim admin visit a crafted URL.\n- **Low Attack Complexity:** The attacker only needs their own registration email to get their UUID. The CSRF payload is a plain GET request via an image tag -- no JavaScript required.\n- **Delegated Right:** The required victim right (`rol_approve_users`) is a common delegation target in organizations with membership approval workflows.\n\n## Recommended Fix\n\nAdd `SecurityUtils::validateCsrfToken($_POST[\"adm_csrf_token\"])` at the beginning of each approval action, consistent with how `delete_user` is already protected in the same file.\n\n```php\n// File: modules/registration.php\n\n} elseif (in_array($getMode, array(\u0027assign_member\u0027, \u0027assign_user\u0027))) {\n    // ADD: validate CSRF token\n    SecurityUtils::validateCsrfToken($_POST[\u0027adm_csrf_token\u0027]);\n    $registrationService = new RegistrationService($gDb, $getUserUUID);\n    $message = $registrationService-\u003eassignRegistration($getUserUUIDAssigned, $getMode === \u0027assign_member\u0027);\n    ...\n\n} elseif ($getMode === \u0027create_user\u0027) {\n    // ADD: validate CSRF token\n    SecurityUtils::validateCsrfToken($_POST[\u0027adm_csrf_token\u0027]);\n    $registrationUser-\u003eacceptRegistration();\n    ...\n\n} elseif ($getMode === \u0027delete_user\u0027) {\n    SecurityUtils::validateCsrfToken($_POST[\u0027adm_csrf_token\u0027]); // already protected\n    $registrationUser-\u003edelete();\n}\n```\n\nAdditionally, convert the approval action URLs from GET-based links to POST-form buttons (with the CSRF token in a hidden field). The existing `delete_user` button uses `callUrlHideElement()` which already sends the token in the POST body -- use the same pattern for approval buttons.",
  "id": "GHSA-ph84-r98x-2j22",
  "modified": "2026-03-31T23:11:24Z",
  "published": "2026-03-31T23:11:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-ph84-r98x-2j22"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34384"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Admidio/admidio/commit/707171c188b3e8f36007fc3f2bccbfac896ed019"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Admidio/admidio"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Admidio has Missing CSRF Protection on Registration Approval Actions"
}