What is the CVSS score of CVE-2026-32818?

CVE-2026-32818 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-32818?

Organizations using versions 5.0.0 should be aware of notable risk from CVE-2026-32818, a missing authorization vulnerability rated CVSS 6.5.. A patch is available.

How to fix or mitigate CVE-2026-32818?

Within 30 days: Identify affected systems running versions 5.0.0 and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP CVE-2026-32818

MEDIUM

Missing Authorization (CWE-862)

2026-03-19 security-advisories@github.com

GHSA-g375-5wmp-xr78

PHP CSRF Authentication Bypass

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 19, 2026 - 23:30 vuln.today

CVE Published

Mar 19, 2026 - 23:16 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the forum module in Admidio does not verify whether the current user has permission to delete forum topics or posts. Both the topic_delete and post_delete actions in forum.php only validate the CSRF token but perform no authorization check before calling delete(). Any authenticated user with forum access can delete any topic (with all its posts) or any individual post by providing its UUID. This is inconsistent with the save/edit operations, which properly check isAdministratorForum() and ownership before allowing modifications. Any logged-in user can permanently and irreversibly delete any forum topic (including all its posts) or any individual post by simply knowing its UUID (which is publicly visible in URLs), completely bypassing authorization checks. This issue has been fixed in version 5.0.7.

AnalysisAI

Admidio versions 5.0.0 through 5.0.6 contain an authorization bypass vulnerability in the forum module that allows any authenticated user to permanently delete forum topics and posts without proper permission checks. An attacker with basic forum access can delete any topic or post by knowing its UUID, which is publicly visible in URLs, completely circumventing the authorization controls that are properly enforced in edit/save operations. This vulnerability was fixed in version 5.0.7, and exploitation requires only low privileges (authenticated user status) with no user interaction.

Technical ContextAI

Admidio is an open-source PHP-based user management solution that includes a forum module. The vulnerability exists in the forum.php file where the topic_delete and post_delete actions fail to implement authorization checks before invoking delete() operations. While CSRF token validation is performed (mitigating cross-site request forgery), there is no call to isAdministratorForum() or ownership verification before deletion, creating a broken access control pattern classified under CWE-862 (Missing Authorization). This represents an inconsistency with the application's own security model, as edit and save operations correctly implement these authorization checks. The affected product is Admidio (identifiable through PHP-based forum management software), with the specific vulnerability impacting the forum subsystem's access control mechanisms.

RemediationAI

Immediately upgrade Admidio to version 5.0.7 or later, which implements proper authorization checks in the forum_delete and post_delete actions. The patch enforces isAdministratorForum() and ownership verification before allowing deletions, bringing delete operations into alignment with the application's existing authorization model for edit operations. See the official release at https://github.com/Admidio/admidio/releases/tag/v5.0.7 and the security advisory at https://github.com/Admidio/admidio/security/advisories/GHSA-g375-5wmp-xr78 for implementation details. Until patching is possible, restrict forum access to trusted users only by removing or disabling forum module access for untrusted accounts, and implement database backups to enable rapid recovery if malicious deletions occur. Monitor forum deletion activity and audit logs for suspicious patterns indicating unauthorized deletion attempts.