CVE-2026-69093: Admidio before 5.0.11 CSRF via category-report preferences
Admidio before 5.0.11 does not validate the admcsrftoken in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters (delete and copy). An attacker can trick an authenticated administrator into visiting a crafted URL to delete or duplicate Category Report configurations, affecting the integrity and availability of that module's configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
admidioto a version that resolves this vulnerability.Fixed in 5.0.11 - Compensating control
Mitigate the persistent CSRF impact by restricting access to modules/category-report/preferences.php (and the Category Report configuration actions it triggers) so only trusted administrators can reach it, e.g., via network/firewall/ACL controls.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-69093?
CVE-2026-69093 has a medium severity rating of 4.6.
How can I fix CVE-2026-69093?
To fix CVE-2026-69093, upgrade Admidio to version 5.0.11 or later.
What type of vulnerability is CVE-2026-69093?
CVE-2026-69093 is a Cross-Site Request Forgery (CSRF) vulnerability.
What impact does CVE-2026-69093 have?
CVE-2026-69093 allows an attacker to make persistent changes to Category Report configurations by tricking an authenticated administrator.
In which component of Admidio is CVE-2026-69093 found?
CVE-2026-69093 is found in the modules/category-report/preferences.php component of Admidio.