Read the docs
TI-2026-76120 Aliases CVE-2026-111913GHSA-4hmr-7mxw-r92p

Authorization bypass in Admidio list export via pdfl mode

Priority MEDIUM 57CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-285.

Summary

Admidio from 5.0.0 before 5.0.16 contains an authorization bypass in lists_show.php. The groups_roles_export check omits the pdfl mode, so authenticated users with list view rights can export member lists as PDF files despite export restrictions, which is an improper authorization flaw (CWE-285). An attacker needs a low-privilege account on a network-reachable instance, and the flaw does not affect integrity or availability. CISA SSVC rates exploitation as proof of concept, but the flaw is not listed in CISA KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl. The groups_roles_export check in modules/groups-roles/lists_show.php omits pdfl, which later runs the pdf export, letting users with list view rights download member lists as PDF files.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00228 13th percentileScored 2026-11-07
Fix Fixed admidio (Admidio): 5.0.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Admidioadmidio5.0.0 to before 5.0.165.0.16Patch availableCNA
  • admidio VendorAdmidio Affected 5.0.0 to before 5.0.16 Fixed in 5.0.16 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*——Admidio
  • cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:* Versions — — ·Admidio

Remediation

Update Admidio to version 5.0.16 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA admidio (Admidio) Fixed in 5.0.16

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    admidio 5.0.16

    4 records Highest priority Priority HIGH 1 HIGH, 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-76122 Missing authorization in Admidio weblinks RSS feed exposes restricted linksPriority HIGH 70
    • TI-2026-76121 Missing authorization in Admidio exposes inventory data when module is disabledPriority MEDIUM 64
    • TI-2026-76119 Admidio IDOR lets members edit other users' forum topicsPriority LOW 31
    Show all 4 records →

Timeline

  1. 2026-10-18 Threatist record created from CVE-2026-111913
  2. 2026-10-18 Alias added: GHSA-4hmr-7mxw-r92p
  3. 2026-10-20 CISA SSVC decision points changed
  4. 2026-10-20 Priority changed: LOW → MEDIUM

References

Advisory 1

  • TI-2026-25286 Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion CVSS 3.1CRITICAL 9.1
  • TI-2026-56995 Admidio before 5.0.12 Authentication Bypass via RSS feeds CVSS 4.0HIGH 8.7
  • TI-2026-56993 Admidio before 5.0.12 SQL Injection via relation_type_list CVSS 4.0HIGH 8.7
  • TI-2024-25222 Admidio has Blind SQL Injection in ecard_send.php CVSS 3.1CRITICAL 10.0
  • TI-2026-30186 Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed CVSS 3.1HIGH 8.2
  • TI-2024-25764 Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment CVSS 3.1CRITICAL 9.1
See all 72 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences