Admidio
Monthly
Unauthenticated information disclosure in Admidio before 5.0.12 exposes private forum and announcement content through unprotected RSS feed endpoints. Remote attackers with no credentials can retrieve full post text, titles, author names, and timestamps from modules explicitly configured as login-only, bypassing the intended access restriction entirely. No public exploit code has been identified and the CVE is not in CISA KEV, but the attack requires nothing more than a standard HTTP GET request, making it trivially executable against any reachable instance.
Blind SQL injection in Admidio before 5.0.12 allows unauthenticated remote attackers to extract full database contents - including password hashes and user credentials - via the `relation_type_list` parameter of `lists_show.php`. Authentication is circumvented by supplying a dummy UUID in the `role_list` parameter, requiring no valid session or credentials against a default installation. No public exploit code or CISA KEV entry has been identified at time of analysis, but the low-complexity, zero-authentication nature of this flaw makes exploitation straightforward once the attack pattern is known.
Cross-site request forgery in Admidio's Category Report preferences module (all versions before 5.0.11) enables an unauthenticated attacker to silently delete or duplicate Category Report configurations by tricking an authenticated administrator into visiting a crafted URL. The endpoint modules/category-report/preferences.php processes state-changing delete and copy operations via HTTP GET parameters without validating the adm_csrf_token, meaning any browser request carrying a valid admin session cookie will be executed regardless of origin. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; risk is constrained by the social engineering prerequisite.
Authentication bypass in Admidio's forum module before version 5.0.11 enables unauthenticated network-accessible attackers to read private forum topics and posts that administrators intended to restrict to logged-in members. The flaw stems from `modules/forum.php` failing to validate the login-only configuration state before serving content, meaning a direct HTTP request with read-only parameters is sufficient to circumvent the access gate. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV, but the mechanistic simplicity of the bypass - a direct module access with no authentication - means exploitation requires minimal skill once a vulnerable, login-only-configured instance is located.
Admidio prior to version 5.0.8 allows attackers with pending registration status to bypass CSRF protections and trick administrators with approval rights into automatically approving registrations via malicious URLs, enabling unauthorized account activation without manual review. The vulnerability affects the create_user, assign_member, and assign_user action modes in modules/registration.php, which process GET requests without token validation unlike the delete_user mode in the same file. An attacker extracts their user UUID from a registration confirmation email, crafts a URL targeting administrators, and gains illicit account approval through social engineering rather than technical compromise.
Unauthenticated remote access to restricted documents in Admidio 5.0.0-5.0.7 Docker deployments allows disclosure of role-protected files. The Docker image's Apache configuration disables .htaccess processing (AllowOverride None), bypassing intended access controls on uploaded documents. Attackers can directly retrieve files via HTTP without authentication using paths disclosed in upload response JSON. CVSS 7.5 (High) with network-based attack vector and no authentication required. No public exploit identified at time of analysis, though exploitation is straightforward given the configuration flaw.
Admidio versions 5.0.0 through 5.0.6 contain a critical authorization bypass vulnerability in the documents and files module that allows unauthorized deletion of folders and files. When the module is configured in public mode, unauthenticated attackers can permanently destroy the entire document library via simple HTTP GET requests without CSRF protection. The vulnerability combines missing authorization checks (CWE-862) with CSRF weaknesses, resulting in a CVSS score of 9.1 (Critical) with network-based attack vector requiring no privileges or user interaction.
Broken access control in Admidio's profile_function.php allows any authenticated low-privilege user to enumerate another user's future role memberships by directly invoking the reload_future_memberships endpoint with a known victim UUID. Affected are all Admidio installations running versions prior to 5.0.12. An attacker with a valid account can bypass profile-level authorization to harvest sensitive organizational membership planning data without elevated privileges; no public exploit code has been identified at time of analysis.
Zip Slip-style path traversal in Admidio's photo ZIP download feature allows authenticated users who hold album-creation rights to embed directory traversal sequences in album names, which are then reflected verbatim as archive entry paths. When a recipient extracts the resulting ZIP, files may be written outside the intended target directory, providing a limited but real filesystem write primitive on the extracting machine. No public exploit code has been identified at time of analysis; the CVSS 4.0 base score of 2.1 reflects the multiple preconditions - authentication, user interaction, and high attack complexity - that constrain real-world exploitability.
Insecure Direct Object Reference in Admidio before 5.0.11 allows authenticated low-privilege users to hijack list configurations managed by administrators or other users by manipulating the list_uuid parameter in the save_temporary mode of mylist_function.php. Any user with a valid session can enumerate global list UUIDs and submit crafted requests to overwrite admin-curated global lists or private lists belonging to other users, effectively transferring ownership and demoting shared resources to personal configurations. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 5.0.11.
Reflected XSS in Admidio's SSO/SAML endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in victims' browsers by injecting payloads into SAML Issuer elements or LightSaml library parameters, which the server echoes back unencoded in exception messages. All Admidio installations before version 5.0.11 with SSO/SAML functionality enabled are affected. Successful exploitation can lead to session hijacking and account takeover. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
Cross-organization role manipulation in Admidio before 5.0.11 allows authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations hosted on the same instance. The flaw exists because `groups_roles.php` handlers accept role UUIDs without verifying that the target role belongs to the requesting user's organization, enabling cross-tenant privilege structure sabotage. No public exploit has been identified at time of analysis; vendor-released patch version 5.0.11 is available.
Admidio 3.3.5 contains a cross-site request forgery vulnerability that allows low-privilege users to increase their permissions by exploiting improper origin checking. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Admidio versions prior to 5.0.8 allow authenticated users to bypass CSRF token validation and server-side form validation in the inventory module's item_save endpoint by setting the imported POST parameter to true, enabling unauthorized modification of inventory item data without proper security checks. The vulnerability requires valid authentication but carries moderate impact due to the complete circumvention of two independent security controls.
Admidio 5.0.0 through 5.0.7 allows authenticated users to permanently delete list configurations via CSRF attacks in the mylist_function.php delete handler, lacking CSRF token validation. An attacker can craft a malicious page to silently destroy a victim's shared list configurations, including organization-wide lists if the victim holds administrator rights. No public exploit code has been identified at time of analysis. Vendor-released patch: version 5.0.8.
Admidio versions 5.0.0 through 5.0.6 contain an authorization bypass vulnerability in the forum module that allows any authenticated user to permanently delete forum topics and posts without proper permission checks. An attacker with basic forum access can delete any topic or post by knowing its UUID, which is publicly visible in URLs, completely circumventing the authorization controls that are properly enforced in edit/save operations. This vulnerability was fixed in version 5.0.7, and exploitation requires only low privileges (authenticated user status) with no user interaction.
Admidio versions 5.0.0 through 5.0.6 contain a critical cross-site request forgery (CSRF) vulnerability in the groups-roles management module that allows unauthenticated attackers to trick privileged users into permanently deleting organizational roles, deactivating groups, or revoking memberships through forged POST requests. The vulnerability affects users with rol_assign_roles privileges, and exploited attacks result in permanent data loss including cascading deletion of role memberships, event associations, and access rights with no built-in undo mechanism. A patch is available in version 5.0.7, and the vulnerability is not currently tracked in active exploitation databases but poses significant organizational impact due to the permanent nature of role deletion and the low barrier to discovery of target role UUIDs from publicly accessible card views.
Unauthorized event participation manipulation in Admidio prior to 5.0.6 allows authenticated users to register or cancel participation for other users by manipulating the user_uuid parameter in event functions. Any user with event participation privileges can exploit this to modify another user's event enrollment status without authorization. The vulnerability requires authentication and affects confidentiality through unauthorized modifications.
Admidio is an open-source user management solution. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Admidio is a free, open source user management system for websites of organizations and groups. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Admidio is a free, open source user management system for websites of organizations and groups. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Admidio v4.2.12 and below is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository admidio/admidio prior to 4.2.8. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Admidio 4.1.2 version is affected by stored cross-site scripting (XSS). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Admidio is a free open source user management system for websites of organizations and groups. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Admidio is a free, open source user management system for websites of organizations and groups. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL Injection was discovered in Admidio before version 3.3.13. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
admidio 3.2.8 has CSRF in adm_program/modules/members/members_function.php with an impact of deleting arbitrary user accounts. Rated medium severity (CVSS 4.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
SQL Injection was discovered in adm_program/modules/dates/dates_function.php in Admidio 3.2.5. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated information disclosure in Admidio before 5.0.12 exposes private forum and announcement content through unprotected RSS feed endpoints. Remote attackers with no credentials can retrieve full post text, titles, author names, and timestamps from modules explicitly configured as login-only, bypassing the intended access restriction entirely. No public exploit code has been identified and the CVE is not in CISA KEV, but the attack requires nothing more than a standard HTTP GET request, making it trivially executable against any reachable instance.
Blind SQL injection in Admidio before 5.0.12 allows unauthenticated remote attackers to extract full database contents - including password hashes and user credentials - via the `relation_type_list` parameter of `lists_show.php`. Authentication is circumvented by supplying a dummy UUID in the `role_list` parameter, requiring no valid session or credentials against a default installation. No public exploit code or CISA KEV entry has been identified at time of analysis, but the low-complexity, zero-authentication nature of this flaw makes exploitation straightforward once the attack pattern is known.
Cross-site request forgery in Admidio's Category Report preferences module (all versions before 5.0.11) enables an unauthenticated attacker to silently delete or duplicate Category Report configurations by tricking an authenticated administrator into visiting a crafted URL. The endpoint modules/category-report/preferences.php processes state-changing delete and copy operations via HTTP GET parameters without validating the adm_csrf_token, meaning any browser request carrying a valid admin session cookie will be executed regardless of origin. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; risk is constrained by the social engineering prerequisite.
Authentication bypass in Admidio's forum module before version 5.0.11 enables unauthenticated network-accessible attackers to read private forum topics and posts that administrators intended to restrict to logged-in members. The flaw stems from `modules/forum.php` failing to validate the login-only configuration state before serving content, meaning a direct HTTP request with read-only parameters is sufficient to circumvent the access gate. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV, but the mechanistic simplicity of the bypass - a direct module access with no authentication - means exploitation requires minimal skill once a vulnerable, login-only-configured instance is located.
Admidio prior to version 5.0.8 allows attackers with pending registration status to bypass CSRF protections and trick administrators with approval rights into automatically approving registrations via malicious URLs, enabling unauthorized account activation without manual review. The vulnerability affects the create_user, assign_member, and assign_user action modes in modules/registration.php, which process GET requests without token validation unlike the delete_user mode in the same file. An attacker extracts their user UUID from a registration confirmation email, crafts a URL targeting administrators, and gains illicit account approval through social engineering rather than technical compromise.
Unauthenticated remote access to restricted documents in Admidio 5.0.0-5.0.7 Docker deployments allows disclosure of role-protected files. The Docker image's Apache configuration disables .htaccess processing (AllowOverride None), bypassing intended access controls on uploaded documents. Attackers can directly retrieve files via HTTP without authentication using paths disclosed in upload response JSON. CVSS 7.5 (High) with network-based attack vector and no authentication required. No public exploit identified at time of analysis, though exploitation is straightforward given the configuration flaw.
Admidio versions 5.0.0 through 5.0.6 contain a critical authorization bypass vulnerability in the documents and files module that allows unauthorized deletion of folders and files. When the module is configured in public mode, unauthenticated attackers can permanently destroy the entire document library via simple HTTP GET requests without CSRF protection. The vulnerability combines missing authorization checks (CWE-862) with CSRF weaknesses, resulting in a CVSS score of 9.1 (Critical) with network-based attack vector requiring no privileges or user interaction.
Broken access control in Admidio's profile_function.php allows any authenticated low-privilege user to enumerate another user's future role memberships by directly invoking the reload_future_memberships endpoint with a known victim UUID. Affected are all Admidio installations running versions prior to 5.0.12. An attacker with a valid account can bypass profile-level authorization to harvest sensitive organizational membership planning data without elevated privileges; no public exploit code has been identified at time of analysis.
Zip Slip-style path traversal in Admidio's photo ZIP download feature allows authenticated users who hold album-creation rights to embed directory traversal sequences in album names, which are then reflected verbatim as archive entry paths. When a recipient extracts the resulting ZIP, files may be written outside the intended target directory, providing a limited but real filesystem write primitive on the extracting machine. No public exploit code has been identified at time of analysis; the CVSS 4.0 base score of 2.1 reflects the multiple preconditions - authentication, user interaction, and high attack complexity - that constrain real-world exploitability.
Insecure Direct Object Reference in Admidio before 5.0.11 allows authenticated low-privilege users to hijack list configurations managed by administrators or other users by manipulating the list_uuid parameter in the save_temporary mode of mylist_function.php. Any user with a valid session can enumerate global list UUIDs and submit crafted requests to overwrite admin-curated global lists or private lists belonging to other users, effectively transferring ownership and demoting shared resources to personal configurations. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 5.0.11.
Reflected XSS in Admidio's SSO/SAML endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in victims' browsers by injecting payloads into SAML Issuer elements or LightSaml library parameters, which the server echoes back unencoded in exception messages. All Admidio installations before version 5.0.11 with SSO/SAML functionality enabled are affected. Successful exploitation can lead to session hijacking and account takeover. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
Cross-organization role manipulation in Admidio before 5.0.11 allows authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations hosted on the same instance. The flaw exists because `groups_roles.php` handlers accept role UUIDs without verifying that the target role belongs to the requesting user's organization, enabling cross-tenant privilege structure sabotage. No public exploit has been identified at time of analysis; vendor-released patch version 5.0.11 is available.
Admidio 3.3.5 contains a cross-site request forgery vulnerability that allows low-privilege users to increase their permissions by exploiting improper origin checking. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Admidio versions prior to 5.0.8 allow authenticated users to bypass CSRF token validation and server-side form validation in the inventory module's item_save endpoint by setting the imported POST parameter to true, enabling unauthorized modification of inventory item data without proper security checks. The vulnerability requires valid authentication but carries moderate impact due to the complete circumvention of two independent security controls.
Admidio 5.0.0 through 5.0.7 allows authenticated users to permanently delete list configurations via CSRF attacks in the mylist_function.php delete handler, lacking CSRF token validation. An attacker can craft a malicious page to silently destroy a victim's shared list configurations, including organization-wide lists if the victim holds administrator rights. No public exploit code has been identified at time of analysis. Vendor-released patch: version 5.0.8.
Admidio versions 5.0.0 through 5.0.6 contain an authorization bypass vulnerability in the forum module that allows any authenticated user to permanently delete forum topics and posts without proper permission checks. An attacker with basic forum access can delete any topic or post by knowing its UUID, which is publicly visible in URLs, completely circumventing the authorization controls that are properly enforced in edit/save operations. This vulnerability was fixed in version 5.0.7, and exploitation requires only low privileges (authenticated user status) with no user interaction.
Admidio versions 5.0.0 through 5.0.6 contain a critical cross-site request forgery (CSRF) vulnerability in the groups-roles management module that allows unauthenticated attackers to trick privileged users into permanently deleting organizational roles, deactivating groups, or revoking memberships through forged POST requests. The vulnerability affects users with rol_assign_roles privileges, and exploited attacks result in permanent data loss including cascading deletion of role memberships, event associations, and access rights with no built-in undo mechanism. A patch is available in version 5.0.7, and the vulnerability is not currently tracked in active exploitation databases but poses significant organizational impact due to the permanent nature of role deletion and the low barrier to discovery of target role UUIDs from publicly accessible card views.
Unauthorized event participation manipulation in Admidio prior to 5.0.6 allows authenticated users to register or cancel participation for other users by manipulating the user_uuid parameter in event functions. Any user with event participation privileges can exploit this to modify another user's event enrollment status without authorization. The vulnerability requires authentication and affects confidentiality through unauthorized modifications.
Admidio is an open-source user management solution. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Admidio is a free, open source user management system for websites of organizations and groups. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Admidio is a free, open source user management system for websites of organizations and groups. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Admidio v4.2.12 and below is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository admidio/admidio prior to 4.2.8. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Admidio 4.1.2 version is affected by stored cross-site scripting (XSS). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Admidio is a free open source user management system for websites of organizations and groups. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Admidio is a free, open source user management system for websites of organizations and groups. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL Injection was discovered in Admidio before version 3.3.13. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
admidio 3.2.8 has CSRF in adm_program/modules/members/members_function.php with an impact of deleting arbitrary user accounts. Rated medium severity (CVSS 4.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
SQL Injection was discovered in adm_program/modules/dates/dates_function.php in Admidio 3.2.5. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.