Admidio versions prior to 5.0.11 are vulnerable to a cross‑site request forgery that originates from the category‑report preferences page. Because the adm_csrf_token is not validated for GET requests that change configuration, an attacker can craft a URL containing delete or copy operations and persuade a logged‑in administrator to visit it. Successful exploitation leads to the administrator’s account being used to modify persistent configuration data, resulting in unintended removal or duplication of Category Report settings.

The affected software is Admidio, a web‑based community portal. Any installation running a version earlier than 5.0.11 is potentially vulnerable. The issue exists in the modules/category-report/preferences.php file and affects all users with administrative privileges.

The base CVSS score is 7.1, indicating a high severity weakness. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The attack surface requires the victim to be an authenticated administrator who follows a malicious link, so the practical probability is moderate but non‑negligible in environments where administrator users are frequently exposed to malicious content. Exploitation is straightforward: send a crafted GET request to the preferences page, which deletes or copies configuration entries without confirmation.