CVE-2026-47232 Admidio PKCS#12 private key export action lacks CSRF protection
Attackers can force administrators to export sensitive private keys via forged requests due to missing CSRF protection in Admidio.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-47232?
CVE-2026-47232 is a medium-severity vulnerability in admidio, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive `mode=export` action in `modules/sso/keys.php` exports a PKCS#12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an administrator session can therefore trigger private key export without a valid form token. Version 5.0.10 contains a fix.
Weakness: CWE-352
Which versions are affected by CVE-2026-47232?
2 open source packages ship an affected version, including admidio/admidio.
| Package | Affected | Fixed in |
|---|---|---|
admidio/admidio Packagist | All versions | 5.0.10 |
admidio/admidio Packagist | All versions | 5.0.10 |
How do I fix CVE-2026-47232?
Upgrade admidio/admidio to 5.0.10 or later.
Is CVE-2026-47232 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47232 exists.
Sources
Also known as GHSA-4rgq-38mh-9xqg.