The flaw allows a user to trigger approval of pending registrations through an unauthenticated GET request, because the create_user, assign_member, and assign_user actions in modules/registration.php lack CSRF token validation. A crafted link that contains a pending registration’s UUID can automatically approve the account when an authorized user with the rol_approve_users right clicks it. This bypasses the intended manual review, permitting the attacker to establish an account with whatever roles are granted by the approval workflow, thereby potentially elevating their privileges within the application. The weakness is categorized as a missing CSRF protection (CWE‑352).

Admidio, the open‑source user‑management platform, is affected for all releases prior to version 5.0.8. Any installation where the registration approval features are enabled and users are granted the rol_approve_users right is potentially vulnerable. The issue exists specifically in the modules/registration.php file handling the create_user, assign_member, and assign_user action modes.

The CVSS score of 4.5 indicates a moderate impact, while the EPSS score of less than 1 % suggests that exploitation is uncommon. Because the flaw requires an authorized approver to click a crafted link, the attack surface is limited to applications that grant the rol_approve_users permission to a broader set of users. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via a crafted HTTP GET request delivered through phishing or social engineering; the attacker can pre‑generate the approval URL after submitting a pending registration and then trick a legitimate approver into visiting it.