CVE-2026-53760 Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests
An attacker can force an authenticated administrator to install, uninstall, or update plugins via CSRF, potentially destroying plugin data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-53760?
CVE-2026-53760 is a medium-severity vulnerability in admidio, published on 4 Sep 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include SameSite=Lax session cookies. An attacker crafts a malicious page that, when an authenticated administrator visits it, triggers arbitrary plugin operations. The uninstall operation executes DROP TABLE SQL scripts and destroys plugin data. This issue has been patched via commit 056b1bd.
Weakness: CWE-352
Which versions are affected by CVE-2026-53760?
2 open source packages ship an affected version, including admidio/admidio.
| Package | Affected | Fixed in |
|---|---|---|
admidio/admidio Packagist | All versions to 5.0.11 | None |
admidio/admidio Packagist | All versions to 5.0.11 | None |
How do I fix CVE-2026-53760?
No fix has been published for CVE-2026-53760 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-53760 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53760 exists.
Sources
Also known as GHSA-hm42-q32m-vj4f.