EUVD-2026-278555

fkie_cve-2026-34382

Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, the delete mode handler in mylist_function.php permanently deletes list configurations without validating a CSRF token. An attacker who can lure an authenticated user to a malicious page can silently destroy that user's list configurations — including organization-wide shared lists when the victim holds administrator rights. This issue has been patched in version 5.0.8.

GHSA-g3mx-8jm6-rc85 — Admidio has Missing CSRF Protections on Custom List Deletion in mylist_function.php

Affected: Packagist: admidio/admidio

**Reported by:** Juan Felipe Oz [@JF0x0r](https://x.com/PwnedRar_) > [LinkedIn](https://www.linkedin.com/in/juanfelipeoz/)

### Summary

The `delete` mode handler in `mylist_function.php` permanently deletes list configurations without validating a CSRF token. An attacker who can lure an authenticated user to a malicious page can silently destroy that user's list configurations — including organization-wide shared lists when the victim holds administrator rights.

### Vulnerable Code File: `modules/groups-roles/mylist_function.php`

The CSRF token validation at lines **81–82** is scoped exclusively to the save, save_as, and save_temporary modes:

```php // Line 81-82 — only runs for save modes $categoryReportConfigForm = $gCurrentSession->getFormObject($_POST['adm_csrf_token']); if ($_POST['adm_csrf_token'] !== $categoryReportConfigForm->getCsrfToken()) { throw new Exception('Invalid or missing CSRF token!'); } ```

The `delete` case at lines **159–161** executes the destructive operation with no token check:

```php } elseif ($getMode === 'delete') { // delete list configuration $list->delete(); // no CSRF validation echo json_encode(array('status' => 'success', ...)); exit(); } ```

A global…

Most recent entries from all

EUVD-2026-278555

fkie_cve-2026-34382

GHSA-g3mx-8jm6-rc85 — Admidio has Missing CSRF Protections on Custom List Deletion in mylist_function.php