CVE-2026-34383

LowCVSS 3.5/10Last modified Oct 6, 2026

Description

Admidio is an open-source user management solution. Prior to version 5.0.8, the inventory module's item_save endpoint accepts a user-controllable POST parameter imported that, when set to true, completely bypasses both CSRF token validation and server-side form validation. An authenticated user can craft a direct POST request to save arbitrary inventory item data without CSRF protection and without the field value checks that the FormPresenter validation normally enforces. This issue has been patched in version 5.0.8.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20 CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Mar 31, 2026
Last modified: Oct 6, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-343847.3Admidio is an open-source user management solution. Prior to version 5.0.8, the create_user, assign_member, and assign_user action modes in CVE-2026-343858.1Fleet is open source device management software. Prior to 4.81.0, a second-order SQL injection vulnerability in Fleet's Apple MDM profile de CVE-2026-343868.8Fleet is open source device management software. Prior to 4.81.0, a SQL injection vulnerability in Fleet's MDM bootstrap package configurati CVE-2026-343879.8Fleet is open source device management software. Prior to 4.81.1, a command injection vulnerability in Fleet's software installer pipeline a CVE-2026-343887.5Fleet is open source device management software. Prior to 4.81.0, a denial-of-service vulnerability in Fleet's gRPC Launcher endpoint allows CVE-2026-343896.5Fleet is open source device management software. Prior to 4.81.0, Fleet contained an issue in the user invitation flow where the email addre CVE-2026-34394.9A post-authentication Stack-based Buffer Overflow vulnerability in SonicOS certificate handling allows a remote attacker to crash a firewall CVE-2026-343905.1Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior have a Privilege Escalation vulnerability where ins CVE-2026-343917.5Fleet is open source device management software. Prior to 4.81.1, a vulnerability in Fleet's Windows MDM command processing allows a malicio CVE-2026-343927.5LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neur CVE-2026-343938.8Weblate is a web based localization tool. In versions prior to 5.17, the user patching API endpoint didn't properly limit the scope of edits CVE-2026-343948.1WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's admin plugin configuration endpoint (admin/save.json.php)