CVE-2026-69093

mediumCVSS 4.6covered by 1 sourcefirst seen 2026-08-03

Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters (delete and copy). An attacker can trick an authenticated administrator into visiting a crafted URL to delete or duplicate Category Report configurations, affecting the integrity and availability of that module's configuration.

⚡ Watch CVE-2026-69093

Get an email if CVE-2026-69093 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

mediumCVE-2026-69093: Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferen…nvd · 2026-08-03

External references

NVD record for CVE-2026-69093

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-69093 status](https://www.csirts.com/badge/CVE-2026-69093)](https://www.csirts.com/cve/CVE-2026-69093)