TI-2026-76119 Aliases CVE-2026-111912 GHSA-j6q3-mqjq-8j39

Admidio IDOR lets members edit other users' forum topics

LOW 31CWE-639Published 2026-10-17 · Updated 2026-10-19

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference in ForumService::saveTopic() (CWE-639). An authenticated member with low privileges can modify forum topics belonging to other users. By changing the topic identifier in their own topic save request and reusing their CSRF token, an attacker can overwrite the title and first post of a victim's topic.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users' forum topics. Attackers can replace the topic_uuid parameter in their own topic_save request, reusing their CSRF token, to overwrite the victim topic's title and first post.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00219 12th percentileScored 2026-11-07

Fix Fixed admidio (Admidio): 5.0.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Admidio	admidio	5.0.0 to before 5.0.16	5.0.16	Patch available	CNA

admidio VendorAdmidio Affected 5.0.0 to before 5.0.16 Fixed in 5.0.16 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:admidio:admidio::::::::	—	—	Admidio

cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:* Versions — — ·Admidio

Remediation

Upgrade Admidio to version 5.0.16 or later, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA admidio (Admidio) Fixed in 5.0.16

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-17
admidio 5.0.16
4 records Highest priority Priority HIGH 1 HIGH, 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-76122 Missing authorization in Admidio weblinks RSS feed exposes restricted linksPriority HIGH 70
- TI-2026-76121 Missing authorization in Admidio exposes inventory data when module is disabledPriority MEDIUM 64
- TI-2026-76120 Authorization bypass in Admidio list export via pdfl modePriority MEDIUM 57
Show all 4 records →

Timeline

2026-10-18 Threatist record created from CVE-2026-111912
2026-10-18 Alias added: GHSA-j6q3-mqjq-8j39
2026-10-18 Priority changed: MEDIUM → LOW
2026-10-19 CISA SSVC decision points changed

References

Advisory 1

GitHub Security Advisory (GHSA-8256-4wm7-f628)

TI-2026-25286 Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion CVSS 3.1CRITICAL 9.1
TI-2026-56995 Admidio before 5.0.12 Authentication Bypass via RSS feeds CVSS 4.0HIGH 8.7
TI-2026-56993 Admidio before 5.0.12 SQL Injection via relation_type_list CVSS 4.0HIGH 8.7
TI-2024-25222 Admidio has Blind SQL Injection in ecard_send.php CVSS 3.1CRITICAL 10.0
TI-2026-30186 Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed CVSS 3.1HIGH 8.2
TI-2024-25764 Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment CVSS 3.1CRITICAL 9.1

See all 72 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences