Admidio is an open-source user management solution. "modules/registration.php" mode "send_login" regenerates a random password for "user_uuid_assigned", stores its bcrypt hash in "adm_users.usr_password", and emails the cleartext to that user. Every other state-changing mode in the same file ("assign_member", "assign_user", "delete_user", "create_user") calls "SecurityUtils::validateCsrfToken($_POST['adm_csrf_token'])" first; the "send_login" branch does not. Prior to version 5.0.10, page visited by a registration-administrator can issue the request as a top-level navigation, the browser sends the admin's "SameSite=Lax" cookies, and the server resets the chosen user's password without any further interaction from the admin. Version 5.0.10 fixes the issue.