The vulnerability stems from missing CSRF token checks on several GET requests in Admidio's preferences module. An attacker can embed a malicious link that, when followed by an authenticated administrator, triggers a database backup, writes a new .htaccess file, or sends a test email. This allows the administrator to unknowingly generate sensitive backups, modify server configuration, and send unsolicited emails.

The flaw exists in all Admidio installations running a version older than 5.0.9. The issue was patched in release 5.0.9. Administrators using earlier builds should update to the latest official release.

With a CVSS score of 3.5, the vulnerability is considered low to moderate severity. No exploit probability data is available, and the flaw is not listed in CISA's KEV catalog. The likely attack vector is a web‑based CSRF: the attacker hosts a malicious page that, when opened by a logged‑in admin, causes the admin’s browser to send the vulnerable GET requests. Because SameSite=Lax cookies travel with top‑level navigations, the session cookie is sent automatically, enabling the actions without the admin’s direct interaction.