CVE-2026-34382: Admidio

Medium severity, CVSS 4.6. EPSS: 0.1% chance of exploitation in the next 30 days.

Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, the delete mode handler in mylist_function.php permanently deletes list configurations without validating a CSRF token. An attacker who can lure an authenticated user to a malicious page can silently destroy that user's list configurations — including organization-wide shared lists when the victim holds administrator rights. This issue has been patched in version 5.0.8.

Affected products

• Admidio Admidio: from 5.0.0, before 5.0.8 (fixed in 5.0.8)

Published 2026-03-31. Last modified 2026-10-06.