The vulnerability in Admidio before version 5.0.11 is due to missing validation of the adm_csrf_token in the category-report preferences module. This lack of CSRF protection allows an attacker to induce an authenticated administrator to perform unintended actions such as deleting or copying Category Report configurations via crafted GET requests. The issue impacts the integrity and availability of the affected module's configuration settings. The CVSS 3.1 vector indicates network attack vector, low complexity, requiring privileges and user interaction, with no confidentiality impact but limited integrity and availability impacts.

An attacker can cause an authenticated administrator to unknowingly delete or duplicate Category Report configurations, compromising the integrity and availability of the module's configuration. There is no direct confidentiality impact. The disruption could affect administrative operations related to reporting configurations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links while authenticated and consider restricting administrative access or implementing additional CSRF protections if possible.