Admidio EUVD-2026-103308

Requires a valid authenticated member account on the target Admidio instance (PR:L) with access to the forum module and the ability to create/edit topics, from which the attacker obtains a legitimate CSRF token for their own session. The attacker then manipulates the topic_uuid parameter in the topic_save request because ForumService::saveTopic() does not validate that the requester owns the referenced topic. Limiting factors: exploitation is impossible without a member account, so risk is highest on instances permitting open self-registration; impact is restricted to overwriting other users' forum topic titles and first posts (integrity only) with no data disclosure or service disruption; only versions 5.0.0 through 5.0.15 are affected, with 5.0.16 remediating the ownership check.

This is a genuine but moderate-priority authorization flaw, not a critical one. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) scores 7.1 and correctly reflects a network-reachable, low-complexity attack that requires an authenticated low-privilege account (PR:L) and affects integrity only (VI:H) with no confidentiality or availability impact. Reported by VulnCheck with a coordinated GitHub Security Advisory (GHSA-8256-4wm7-f628), so the technical validity is well-substantiated. However, no EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation status is 'no public exploit identified at time of analysis' - this is not evidence of active exploitation. Note the scale divergence worth flagging to teams: CVSS 4.0 rates this 7.1 (High) while an equivalent CVSS 3.1 assessment lands around 4.3 (Medium), because 3.1 weights integrity-only impacts far lower; the 'High' label overstates real-world urgency. The flaw requires an attacker to already hold a valid member account on the target Admidio instance, limiting it to insiders or communities that allow self-registration, and the impact is confined to defacing/overwriting other members' forum topic titles and first posts - reputational/integrity harm rather than system compromise. Real priority is moderate: patch in routine cycles, prioritize instances with open registration.

An authenticated member of an Admidio community crafts a normal topic_save request to edit one of their own forum topics, then substitutes the topic_uuid of a victim's topic while reusing their own valid CSRF token. The server's ForumService::saveTopic() fails to verify topic ownership, so the victim's topic title and first post are overwritten. No public exploit code was provided, but the technique is trivial to reproduce manually given a member account.