The vulnerability resides in Admidio’s mylist_function.php, where the deletion of list configurations is performed without validating a CSRF token. An attacker can cause an authenticated user to send a delete request that permanently removes the targeted list configuration. If the victim holds administrator rights, organization‑wide shared lists can also be destroyed, resulting in irreversible data loss that can disrupt collaboration and system configurations.

Admidio versions 5.0.0 through 5.0.7 are affected. The issue was addressed in version 5.0.8, which restores CSRF protection for list deletion. Installations that have not applied this update remain vulnerable.

The CVSS score of 4.6 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability does not require special environmental conditions; however, the only stated prerequisite is an authenticated user visiting a malicious link. The likely attack vector is social engineering whereby an attacker lures the user to a malicious page that triggers the deletion. Since the flaw allows permanent deletion of configuration data, it poses a significant risk to data integrity for organizations that rely on shared lists. It is not listed in the CISA KEV catalog.