Admidio is an open-source user management solution. Prior to version 5.0.8, the create_user, assign_member, and assign_user action modes in modules/registration.php approve pending user registrations via GET request without validating a CSRF token. Unlike the delete_user mode in the same file (which correctly validates the token), these three approval actions read their parameters from $_GET and perform irreversible state changes without any protection. An attacker who has submitted a pending registration can extract their own user UUID from the registration confirmation email URL, then trick any user with the rol_approve_users right into visiting a crafted URL that automatically approves the registration. This bypasses the manual registration approval workflow entirely. This issue has been patched in version 5.0.8.

Affected: Packagist: admidio/admidio

## Summary

The create_user, assign_member, and assign_user action modes in modules/registration.php approve pending user registrations via GET request without validating a CSRF token. Unlike the delete_user mode in the same file (which correctly validates the token), these three approval actions read their parameters from $_GET and perform irreversible state changes without any protection. An attacker who has submitted a pending registration can extract their own user UUID from the registration confirmation email URL, then trick any user with the rol_approve_users right into visiting a crafted URL that automatically approves the registration. This bypasses the manual registration approval workflow entirely.

## Details

### CSRF Protection Is Present for delete_user but Absent for Approval Modes

File: modules/registration.php, lines 90-128

The delete_user mode validates the CSRF token (line 99), but the three approval modes do not:

```php // assign_member and assign_user: no CSRF check } elseif (in_array($getMode, array('assign_member', 'assign_user'))) { $registrationService = new RegistrationService($gDb, $getUserUUID); $message = $registrationService->assignRegistration($getUserUUIDAssigned, $getMode === 'assign_member'); $gMessage->setForwardUrl($message['forwardUrl']); $gMessage->show($message['message']);

// create_user: no CSRF check } elseif ($getMode === 'create_user') { $registrationUser->acceptRegistration(); if ($gCurrentUser->isAdmin…