Admidio CVE-2026-111913

Exploitation requires an authenticated Admidio account (PR:L) that has been granted list view rights for a group/role but intended to be denied export rights - the attacker simply requests the groups/roles list with mode=pdfl, which the groups_roles_export authorization check fails to validate. Limiting factors: the attacker must already possess valid credentials and list view permission, so this is not exploitable by anonymous/unauthenticated users; the impact is bounded to downloading member lists as PDF (confidentiality of roster data), with no integrity or availability effect; it only matters in deployments that actually configure export restrictions, since environments granting export rights broadly would see no additional exposure. Affected deployments are Admidio 5.0.0 up to but not including 5.0.16.

This is a genuine but low-to-moderate priority issue, consistent with its CVSS 4.0 base score of 5.3 (Medium). The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N indicates a network-reachable flaw with low attack complexity that requires existing authenticated access (PR:L) and yields only a limited confidentiality impact (VC:L) with no integrity or availability effect. No EPSS score, KEV listing, or SSVC decision data was provided in the input, and there is no public exploit identified at time of analysis - so the only real-world exploitation signal is the structural simplicity of the bypass (appending mode=pdfl), not evidence of actual exploitation. The impact is narrow: it allows an already-trusted user with list view rights to defeat an export restriction and download member lists as PDF, i.e., a policy/authorization bypass rather than privilege escalation or data breach of credentials. Net assessment: real but low-severity; prioritize patching in environments where export restrictions are relied upon for member-data privacy, but it does not warrant emergency response absent exploitation signals.

An authenticated Admidio user who has been granted list view rights but explicitly denied export rights navigates to the groups/roles list view and issues the request with mode=pdfl instead of a blocked export mode. Because the groups_roles_export check in modules/groups-roles/lists_show.php omits the pdfl case, the server proceeds to render and return the member list as a downloadable PDF, bypassing the intended export restriction. No public exploit code is identified at time of analysis, but the technique is trivial to reproduce by manually altering the request parameter.