Admidio versions 5.0.0 through 5.0.6 allow role deletion, activation, and deactivation actions to be performed without validating a CSRF token. The server-side code accepts POST requests for these operations, ignoring the submitted CSRF value, while the client interface includes one. An attacker who knows a role UUID, which is exposed in public cards when the module is accessible, can craft a forged POST form on an external page and trick any user who holds the "rol_assign_roles" permission into executing destructive changes. Role deletion is irreversible and cascades to all related memberships, event associations, and rights data, leading to widespread loss of access to documents, mailing lists, and event participation. Since there is no undo capability beyond a database restore, the impact is severe for organizational integrity and data availability.

The vulnerability affects the Admidio open‑source user management application under the vendor name Admidio, specifically versions 5.0.0 through 5.0.6. The issue was resolved in the subsequent release, Admidio 5.0.7, which adds proper CSRF validation to the affected operations. Users of the older releases are directly exposed to the risk unless they apply the patch.

The CVSS score of 5.7 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Successful exploitation requires that an attacker first identify a valid role UUID—which can be harvested from the public module view—and then persuade the user with "rol_assign_roles" rights to submit a forged form. The attack vector is web‑based, and no authentication bypass is necessary; however, the necessity of a privileged account reduces the overall risk exposure to organizations that strictly limit that role. Given the irreversible effects of role deletion, the potential damage warrants immediate action.