Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, the delete mode handler in mylist_function.php permanently deletes list configurations without validating a CSRF token. An attacker who can lure an authenticated user to a malicious page can silently destroy that user's list configurations — including organization-wide shared lists when the victim holds administrator rights. This issue has been patched in version 5.0.8.

Affected: Packagist: admidio/admidio

**Reported by:** Juan Felipe Oz [@JF0x0r](https://x.com/PwnedRar_) > [LinkedIn](https://www.linkedin.com/in/juanfelipeoz/)

### Summary

The `delete` mode handler in `mylist_function.php` permanently deletes list configurations without validating a CSRF token. An attacker who can lure an authenticated user to a malicious page can silently destroy that user's list configurations — including organization-wide shared lists when the victim holds administrator rights.

### Vulnerable Code File: `modules/groups-roles/mylist_function.php`

The CSRF token validation at lines **81–82** is scoped exclusively to the save, save_as, and save_temporary modes:

```php // Line 81-82 — only runs for save modes $categoryReportConfigForm = $gCurrentSession->getFormObject($_POST['adm_csrf_token']); if ($_POST['adm_csrf_token'] !== $categoryReportConfigForm->getCsrfToken()) { throw new Exception('Invalid or missing CSRF token!'); } ```

<img width="857" height="162" alt="imagen" src="https://github.com/user-attachments/assets/caec390e-ba6f-40f0-bb9c-a8870679da3d" />

The `delete` case at lines **159–161** executes the destructive operation with no token check:

```php } elseif ($getMode === 'delete') { // delete list configuration $list->delete(); // no CSRF validation echo json_encode(array('status' => 'success', ...)); exit(); } ```

<img width="560" height="133" alt="imagen" src="https://github.com/user-attachments/assets/2d5eff8e-bbce-49b9-b6d5-77f4e2e6db69" />

A global…