The vulnerability resides in Admidio 3.3.5’s roles_function.php and allows an attacker to perform a cross‑site request forgery (CSRF) that elevates the privileges of a low‑privilege user. By submitting a crafted HTML form with parameters such as rol_assign_roles, rol_approve_users, and rol_edit_user set to 1, the victim can obtain higher level permissions without needing to authenticate or provide additional credentials. The flaw directly bypasses the origin check that should protect against CSRF attacks, leading to unauthorized privilege escalation on the system.

The affected product is Admidio version 3.3.5, shipped as part of the Admidio:Admidio distribution. No other products or versions are mentioned as affected.

The CVSS score of 6.9 indicates a moderate severity risk level. Because the EPSS score is unavailable, the current public exploitation probability cannot be quantified, but the lack of a KEV listing suggests limited known exploitation activity. The likely attack vector is a traditional web‑based CSRF scenario, inferred from the description that an attacker must craft a malicious form that a vulnerable, low‑privilege user will load. If the user visits or is tricked into submitting the form, the exploit will succeed, granting the attacker unauthorized administrative capabilities. The vulnerability does not provide direct remote code execution but grants escalated privileges, which can lead to far‑reaching compromise of the application and underlying data.