CVE-2026-34383: Admidio has CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter

The inventory module’s item_save endpoint accepts a user-controllable POST parameter imported that, when set to true, completely bypasses both CSRF token validation and server-side form validation. An authenticated user can craft a direct POST request to save arbitrary inventory item data without CSRF protection and without the field value checks that the FormPresenter validation normally enforces.