Admidio versions before 5.0.11 contain a vulnerability in the modules/category-report/preferences.php file where the adm_csrf_token is not validated. This allows an attacker to trick an authenticated administrator into visiting a crafted URL that can delete or duplicate Category Report configurations. The flaw affects the integrity and availability of the Category Report module's configuration. The vulnerability has a CVSS 3.1 score of 4.6, indicating a medium severity impact primarily on integrity and availability with low attack complexity but requiring some user interaction and privileges.