CVE-2026-47228 is a CSRF vulnerability in Admidio's registration module where the send_login mode lacks token validation while its four sibling modes have it. This is not a one-off developer error — it is a structural failure that the development history likely reveals as a pattern: a mode-based dispatch file where four branches were hardened and one was not. The missing check resets any user's password by forcing the registration admin to navigate to a crafted page while authenticated, using the user_uuid_assigned parameter to target the victim.
The practical severity depends on who holds the registration administrator role. If this role is distributed across HR staff, department heads, or team coordinators rather than a single IT admin, the blast radius is wide — compromise of any registration admin enables arbitrary account takeover. The CVSS 5.2 rating may understate this because it doesn't fully account for the attack's trivial execution: it requires no JavaScript, exploits SameSite=Lax cookies through simple navigation, and needs only the target's user UUID.
What you should verify: confirm whether your Admidino deployment is on 5.0.10 or later. Then audit your own registration module — not just for this file, but for any other mode-based dispatch structures in the codebase. The critical question is whether 5.0.10 added middleware-level CSRF enforcement that would automatically cover future modes, or whether it merely patched the missing token call while leaving the per-handler pattern intact. If the architecture still relies on developers manually adding CSRF checks to each new branch, then other files with identical dispatch patterns likely contain identical gaps. The vulnerability is closed in 5.0.10, but the architecture that created it may not be.