Admidio, an open‑source user management platform, has a missing CSRF validation in the save_membership action within the profile module. The bug allows a malicious actor to craft a form that, when submitted by an authenticated role leader, silently changes a member’s role start or end dates. This can prematurely end a member’s access, grant extended privileges, or remove authorized features without the user’s awareness or any administrative confirmation. The underlying weakness corresponds to CWE‑352, which describes a cross‑site request forgery failure.

The vulnerability affects Admidio versions 5.0.6 and earlier. Version 5.0.7 includes the fix. Users of the listed product should verify their installation corresponds to a version older than 5.0.7.

The CVSS score of 5.7 classifies the issue as medium severity. The EPSS score of less than 1% suggests a low exploitation probability, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, the attack vector is inferred to be remote: an attacker can host an external page that automatically posts to the victim’s authenticated session, exploiting the missing CSRF token. The successful exploitation requires that the victim is a role leader with an active session; once triggered, the attacker can silently modify any member’s role membership dates within the victim’s purview.