admidio 3.2.8 has CSRF in admprogram/modules/members/membersfunction.php with an impact of deleting arbitrary user accounts.