Admidio EUVD-2026-103305

No special conditions beyond the feature being in use - remote unauthenticated exploitation against default configurations of Admidio versions before 5.0.16, by sending an HTTP request to the weblinks RSS endpoint (rss/links.php) for a target organization. The only practical limiting factors are: (1) the affected organization must actually use restricted LNK (weblink) categories whose visibility is scoped to specific roles, otherwise there is no sensitive data to leak; (2) the RSS/weblinks feed must be reachable by the attacker (an internet-exposed or otherwise accessible Admidio instance). No authentication, user interaction, or non-default setting is required to trigger the flaw itself.

This is a genuine but moderate-severity exposure rather than a top-priority emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) is internally consistent with the description: a remote, unauthenticated attacker can reach the RSS endpoint over the network with low complexity and no user interaction, but impact is confined to a limited confidentiality loss (VC:L) with no integrity or availability effect - matching CWE-862 (Missing Authorization) and the information-disclosure nature of the flaw. No CVSS 3.1 vector was supplied in the input; the signals are coherent, with no contradiction between the network vector and the described unauthenticated HTTP request. No EPSS score, SSVC decision, KEV listing, or explicit POC reference was provided, so exploitation-likelihood signals are absent rather than conflicting. The 6.9 score is driven by easy, unauthenticated reachability, not by severe impact - the data exposed is role-restricted link metadata, not credentials or system control. Priority should be treated as 'patch in normal cycle' for most, escalating only for organizations that place sensitive information in restricted LNK (weblink) categories. EPSS is unavailable, so widespread-exploitation probability cannot be quantified from the provided data.

An attacker with no account simply requests the weblinks RSS feed (rss/links.php) for a target Admidio organization over the internet. Because the endpoint omits the category_view role-visibility filter, the response discloses names, URLs, descriptions, categories, and creator names of weblinks that were meant to be restricted to specific roles. No public exploit was identified in the provided data, but the attack requires only a crafted HTTP GET request, so weaponization is trivial.