CVE-2026-41663 Admidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email Send
An attacker can force an authenticated admin to trigger unauthorized database backups, .htaccess writes, and email sends via CSRF in Admidio.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-41663?
CVE-2026-41663 is a low-severity vulnerability in admidio, published on 7 May 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Admidio is an open-source user management solution. Prior to version 5.0.9, several administrative operations in Admidio's preferences module (database backup, test email, htaccess generation) fire via GET requests with no CSRF token validation. Because SameSite=Lax cookies travel with top-level GET navigations, an attacker forces an authenticated admin to trigger these actions from a malicious page. This issue has been patched in version 5.0.9.
Weakness: CWE-352
Which versions are affected by CVE-2026-41663?
2 open source packages ship an affected version, including admidio/admidio.
| Package | Affected | Fixed in |
|---|---|---|
admidio/admidio Packagist | All versions | 5.0.9 |
admidio/admidio Packagist | All versions | 5.0.9 |
How do I fix CVE-2026-41663?
Upgrade admidio/admidio to 5.0.9 or later.
Is CVE-2026-41663 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41663 exists.
Sources
Also known as GHSA-rw74-vc9h-534j.