Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation
Date: 2026-05
Affected: composer/admidio/admidio
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-47229
CWE: CWE-352
CVSS: 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L)

## Summary `modules/sso/clients.php` validates an `adm_csrf_token` on every state-changing branch except `enable`. The `enable` case loads the SAML or OIDC client by UUID, calls `$client->enable($enabled)`, and persists the new state with no token check. Because the action is reachable via plain GET parameters, a third-party page can trick an authenticated administrator into disabling (or silently re-enabling) any configured SAML or OIDC client. Disabling an SSO client breaks every downstream relying-party application that authenticates through it. ## Details ### Vulnerable Code `modules/sso/clients.php:84-115` — the file's other branches each begin with `SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']);`, but `case 'enable':` does not: ```php case 'delete_oidc': // check the CSRF token of the form against the session token SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']); $oidcService = new OIDCService($gDb, $gCurrentUser); $client = $oidcService->getClientFromUUID($getClientUUID); $client->delete(); echo json_encode(array('status' => 'success')); break; case 'enable': // <- no CSRF validation $enabled = admFuncVariableIsValid($_GET, 'enabled', 'boolean'); $client = new SAMLClient($gDb); $client->readDataByUuid($getClientUUID); if ($client->isNewRecord()) { // Not a SAML record, so try OIDC: $client = new OIDCClient($gDb); $client->readDataB


Mitigations:

Architectural layers (MAESTRO):