Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2026-41663
CVE-2026-41663:
PHP vulnerability analysis and mitigation
Overview
CVE-2026-41663 is a Cross-Site Request Forgery (CSRF) vulnerability in Admidio's preferences module that allows an attacker to force an authenticated administrator into triggering unauthorized administrative operations — including database backup creation, .htaccess file modification, and test email sends — by luring them to a malicious page. It affects Admidio versions 5.0.8 and earlier; version 5.0.9 contains the fix. The vulnerability was discovered by aisafe.io, published to the GitHub Advisory Database on April 23, 2026, and assigned CVE-2026-41663 on April 29, 2026. It carries a CVSS v3.1 base score of 3.5 (Low) (GitHub Advisory, Admidio Advisory).
Technical details
The root cause is CWE-352 (Cross-Site Request Forgery): the backup, test_email, and htaccess operation modes in modules/preferences.php accept GET requests without any CSRF token validation, even though the save mode in the same file correctly uses getFormObject() for CSRF protection — confirming the omission was unintentional. Because these are top-level GET navigations, browsers operating under SameSite=Lax cookie policy automatically include session cookies, making exploitation trivial with a simple JavaScript redirect (e.g., window.location = 'https://target-admidio.example.com/adm_program/modules/preferences.php?mode=backup'). The only precondition is that the victim must be an authenticated Admidio administrator who visits an attacker-controlled page while their session is active (GitHub Advisory, Admidio Advisory).
Impact
Successful exploitation allows an attacker to force an authenticated Admidio administrator to unknowingly trigger three distinct server-side operations: (1) database backup creation, which generates a full database dump and causes disk I/O and storage pressure (the dump downloads to the victim's browser, not the attacker); (2) .htaccess overwrite, which can break URL routing or disable server-side security headers, disrupting application availability; and (3) test email dispatch, which can abuse the server as a spam relay or probe internal mail infrastructure. There is no direct confidentiality impact to the attacker, as cross-origin response reading is blocked by the browser's same-origin policy (GitHub Advisory).
Exploitability
No public exploit kit or weaponized tooling has been reported for this vulnerability. A proof-of-concept is included in the public GitHub Security Advisory, consisting of a simple HTML page with a JavaScript redirect. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.014% (0th percentile), indicating a very low probability of near-term exploitation (GitHub Advisory).
Exploitation steps
- Identify target: Confirm the target Admidio instance is running version 5.0.8 or earlier and is accessible over the network.
- Craft malicious page: Host an HTML page on an attacker-controlled origin containing a JavaScript redirect to the vulnerable endpoint, e.g.:
<html>
<body>
<h1>Loading...</h1>
<script>window.location = 'https://target-admidio.example.com/adm_program/modules/preferences.php?mode=backup';</script>
</body>
</html>- Deliver link to administrator: Use phishing (email, chat, forum post) to send the URL of the malicious page to an Admidio administrator who is currently logged in.
- Trigger state-changing action: When the administrator visits the page, their browser follows the redirect to the Admidio URL with their session cookie attached (permitted by
SameSite=Lax). The server executes the requested operation (backup,.htaccesswrite, or email send) without any CSRF validation. - Achieve objective: Depending on the
modeparameter used —backupcauses disk pressure;htaccessdisrupts the application;test_emailabuses the mail server as a relay (GitHub Advisory, Admidio Advisory).
Indicators of compromise
- Network: Unexpected GET requests to
/adm_program/modules/preferences.php?mode=backup,?mode=htaccess, or?mode=test_emailoriginating from unusual referrers or with no referrer header. - Logs: Web server access logs showing admin-session GET requests to the preferences module with
mode=backup,mode=htaccess, ormode=test_emailfrom unexpected IP addresses or at unusual times. - File System: Unexpected regeneration or modification timestamps on the server's
.htaccessfile; new database backup files created in the Admidio backup directory at unexpected times. - Mail Server: Unexpected outbound email activity from the Admidio server's mail account, particularly test emails sent outside of normal administrative activity (GitHub Advisory).
Mitigation and workarounds
Admidio has patched this vulnerability in version 5.0.9, released April 18, 2026. The vendor strongly recommends upgrading immediately. The recommended fix involves changing backup, test_email, and htaccess operations to require POST requests and adding CSRF token validation via the existing getFormObject() mechanism. As a defense-in-depth measure, setting SameSite=Strict on session cookies or adding a confirmation step for destructive operations (such as database backup) is also advised. No configuration-only workaround is available for unpatched versions (Admidio Release, GitHub Advisory).
Additional resources
Source: This report was generated using AI
Related PHP vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management