CVE-2026-47232: Admidio PKCS#12 private key export action lacks CSRF protection

May 29, 2026 (updated June 5, 2026)

The sensitive mode=export action in modules/sso/keys.php exports a PKCS#12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an administrator session can therefore trigger private key export without a valid form token.

References

github.com/Admidio/admidio/security/advisories/GHSA-4rgq-38mh-9xqg
github.com/advisories/GHSA-4rgq-38mh-9xqg
nvd.nist.gov/vuln/detail/CVE-2026-47232

Code Behaviors & Features

Detect and mitigate CVE-2026-47232 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →