Which versions of Admidio are affected by CVE-2026-69091?

Admidio's forum module authentication bypass allows unauthorized users to access private member discussions and posts, exposing confidential organizational communications.. A patch is available.

How to fix or mitigate CVE-2026-69091?

Within 24 hours, identify all Admidio deployments configured with private forums and assess which members or content may have been exposed; enable forensic logging of forum access if not already active. Within 7 days, upgrade all affected Admidio instances to version 5.0.11 or later after validating the patch in a staging environment to confirm functionality. Within 30 days, complete the upgrade to all systems, review access logs for unauthorized forum access during the vulnerability window, and confirm that forum access restrictions are functioning as intended post-patch.

Admidio CVE-2026-69091

Q: What is the CVSS score of CVE-2026-69091?

CVE-2026-69091 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-52284 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-08-03 VulnCheck

GHSA-qjhq-374q-29q9

PHP Authentication Bypass Admidio

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable unauthenticated read bypass via direct HTTP request; no integrity or availability impact, confidentiality-only with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 14:23 vuln.today

Patch available

Aug 03, 2026 - 14:02 EUVD

CVE Published

Aug 03, 2026 - 13:20 cve.org

HIGH 8.7

DescriptionCVE.org

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by directly accessing the module with read-only parameters.

AnalysisAI

Authentication bypass in Admidio's forum module before version 5.0.11 enables unauthenticated network-accessible attackers to read private forum topics and posts that administrators intended to restrict to logged-in members. The flaw stems from modules/forum.php failing to validate the login-only configuration state before serving content, meaning a direct HTTP request with read-only parameters is sufficient to circumvent the access gate. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV, but the mechanistic simplicity of the bypass - a direct module access with no authentication - means exploitation requires minimal skill once a vulnerable, login-only-configured instance is located.

Technical ContextAI

Admidio is an open-source PHP community management platform designed for clubs, associations, and volunteer organizations, with functionality for member management, announcements, and forums. The vulnerability resides in modules/forum.php and is rooted in CWE-306 (Missing Authentication for Critical Function): the PHP module performs no check to determine whether the application has been placed in login-only mode before rendering forum content. The affected product span is broad, covering all Admidio releases from the beginning up to but not including 5.0.11, as expressed by CPE cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms network reachability with no authentication, complexity, or special attack preconditions beyond the deployment configuration.

RemediationAI

Upgrade to Admidio 5.0.11 or later, which contains the vendor-released patch correcting the access control logic in modules/forum.php. The fix is documented in the GitHub security advisory at https://github.com/Admidio/admidio/security/advisories/GHSA-cf48-6jrq-gjcm and the VulnCheck advisory at https://www.vulncheck.com/advisories/admidio-before-authentication-bypass-via-forum-php. For deployments unable to patch immediately, enforce authentication at the web server layer by blocking unauthenticated requests to the forum module path (e.g., add a require-valid-user directive in Apache or an auth_basic block in nginx for the modules/forum.php endpoint). This compensating control will block all anonymous forum access - including any intentionally public forum content on other instances - and must be removed once the patch is applied to avoid blocking legitimate authenticated access.