CVE-2026-34383

{"id": "CVE-2026-34383", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34383", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-03T16:30:13.656400Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Admidio", "product": "admidio", "versions": [{"status": "affected", "version": "< 5.0.8"}]}]}], "published": "2026-03-31T21:16:30.343", "references": [{"url": "https://github.com/Admidio/admidio/commit/00494b95dfe847af8b938e4397e5d909d8f36839", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Admidio/admidio/security/advisories/GHSA-4rwm-c5mj-wh7x", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Admidio is an open-source user management solution. Prior to version 5.0.8, the inventory module's item_save endpoint accepts a user-controllable POST parameter imported that, when set to true, completely bypasses both CSRF token validation and server-side form validation. An authenticated user can craft a direct POST request to save arbitrary inventory item data without CSRF protection and without the field value checks that the FormPresenter validation normally enforces. This issue has been patched in version 5.0.8."}, {"lang": "es", "value": "Admidio es una soluci\u00f3n de gesti\u00f3n de usuarios de c\u00f3digo abierto. Antes de la versi\u00f3n 5.0.8, el endpoint item_save del m\u00f3dulo de inventario acepta un par\u00e1metro POST controlable por el usuario imported que, cuando se establece en true, omite completamente tanto la validaci\u00f3n del token CSRF como la validaci\u00f3n del formulario del lado del servidor. Un usuario autenticado puede elaborar una solicitud POST directa para guardar datos arbitrarios de elementos del inventario sin protecci\u00f3n CSRF y sin las comprobaciones de valor de campo que la validaci\u00f3n de FormPresenter normalmente aplica. Este problema ha sido parcheado en la versi\u00f3n 5.0.8."}], "lastModified": "2026-07-24T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "943C8893-5336-477E-9026-C55A9659B1EA", "versionEndExcluding": "5.0.8"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}