CVE-2026-41663

Descripción

Admidio is an open-source user management solution. Prior to version 5.0.9, several administrative operations in Admidio-s preferences module (database backup, test email, htaccess generation) fire via GET requests with no CSRF token validation. Because SameSite=Lax cookies travel with top-level GET navigations, an attacker forces an authenticated admin to trigger these actions from a malicious page. This issue has been patched in version 5.0.9.