Admidio has a Cross‑Site Request Forgery flaw in the registration module’s `send_login` mode that allows an attacker to reset the password of any user. The code path that performs the password generation skips CSRF token validation, so a crafted request that includes the admin’s authentication cookies can trigger a random password to be generated, stored, and emailed to the target user. Because the attacker does not need the victim’s credentials, this flaw can lead to account takeover and loss of confidentiality and integrity of user accounts.

The vulnerability affects the open‑source Admidio user management platform in versions prior to 5.0.10. The issue is present in the modules/registration.php file where the `send_login` branch bypasses CSRF validation. All users of Admidio before the security release are potentially impacted.

The CVSS score of 5.2 indicates medium severity and the EPSS score is not available. Admidio is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is CSRF: an adversary can host a harmless page or craft a link that, when visited by an administrator with an authenticated session, causes the browser to send the session cookies (SameSite=Lax) to the server and reset an arbitrary user’s password. The exploit requires no user interaction beyond a click or navigation and can be performed automatically if the administrator is directed to the malicious page. The absence of a CSRF check means an attacker can target any administrator’s session, making the vulnerability highly exploitable in environments where administrative accounts are active in browsers.