EUVD-2026-52287
GHSA-mmp5-653m-6rjv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible IDOR requiring authenticated low-privilege session; impact is integrity-only - list data overwritten, no confidentiality or availability loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the save_temporary mode of mylist_function.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' private lists by supplying a list_uuid parameter, transferring ownership and demoting global lists to personal configurations.
AnalysisAI
Insecure Direct Object Reference in Admidio before 5.0.11 allows authenticated low-privilege users to hijack list configurations managed by administrators or other users by manipulating the list_uuid parameter in the save_temporary mode of mylist_function.php. Any user with a valid session can enumerate global list UUIDs and submit crafted requests to overwrite admin-curated global lists or private lists belonging to other users, effectively transferring ownership and demoting shared resources to personal configurations. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 5.0.11.
Technical ContextAI
Admidio is an open-source PHP community management platform used to manage members, events, and organizational data. The vulnerability resides in mylist_function.php operating in save_temporary mode, where the application accepts a user-supplied list_uuid parameter to identify which list configuration to persist. CWE-639 (Authorization Through User-Controlled Key) describes this root cause precisely: the application uses an externally supplied identifier to locate and modify database objects without verifying that the requesting user holds authorization over that specific resource. The result is both horizontal privilege escalation (accessing peer users' private lists) and vertical privilege escalation (overwriting admin-owned global lists). The affected CPE is cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*, covering all Admidio versions before 5.0.11.
RemediationAI
Upgrade to Admidio 5.0.11 or later, which resolves the IDOR in mylist_function.php. The vendor-released patch is documented in the GitHub security advisory at https://github.com/Admidio/admidio/security/advisories/GHSA-rw2j-8c57-x6h2. Additional context is available via VulnCheck at https://www.vulncheck.com/advisories/admidio-before-idor-via-save-temporary-mylist-function-php. Prior to patching, administrators should audit existing global list configurations for unexpected ownership transfers and restrict write access to list management endpoints by enforcing tighter application-level role checks. Disabling the list-sharing or save_temporary functionality entirely via application configuration would eliminate the attack surface but would remove list management features for all users.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today