CVE-2026-34383

Admidio: CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter

State: Published
Severity: 4.3 Medium
Published: Mar 31, 2026
Updated: Apr 3, 2026
Reserved: Mar 27, 2026

Description

Admidio is an open-source user management solution. Prior to version 5.0.8, the inventory module's item_save endpoint accepts a user-controllable POST parameter imported that, when set to true, completely bypasses both CSRF token validation and server-side form validation. An authenticated user can craft a direct POST request to save arbitrary inventory item data without CSRF protection and without the field value checks that the FormPresenter validation normally enforces. This issue has been patched in version 5.0.8.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	GitHub_M

Weaknesses

CWE-20 Improper Input Validation
CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Product	Versions
admidioAdmidio	< 5.0.8Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.