CVE-2026-69093 — Admidio before 5.0.11 CSRF via category-report preferences
Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on G…
Published: 2026-08-03 · CVSS: 7.1 · CVSS 4.0
Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters (delete and copy). An attacker can trick an authenticated administrator into visiting a crafted URL to delete or duplicate Category Report configurations, affecting the integrity and availability of that module's configuration.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7