Read the docs
TI-2026-76122 Aliases CVE-2026-111916GHSA-wwg7-jwv4-c2fh

Missing authorization in Admidio weblinks RSS feed exposes restricted links

Priority HIGH 70CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Admidio before 5.0.16 contains an information disclosure flaw in its weblinks RSS feed, rss/links.php. The feed omits the role-visibility filter, so it does not check whether a user may see restricted categories. An unauthenticated remote attacker can request the feed for an organization and read link names, URLs, descriptions, categories and creator names from role-restricted weblinks. The flaw is classified as CWE-862 (Missing Authorization).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because rss/links.php omits the category_view role-visibility filter. Attackers can request the weblinks RSS feed for an organization to retrieve link names, URLs, descriptions, categories, and creator names from restricted LNK categories.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00349 28th percentileScored 2026-11-07
Fix Fixed admidio (Admidio): 5.0.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Admidioadmidiobefore 5.0.165.0.16Patch availableCNA
  • admidio VendorAdmidio Affected before 5.0.16 Fixed in 5.0.16 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*——Admidio
  • cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:* Versions — — ·Admidio

Remediation

Admidio users should upgrade to version 5.0.16 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA admidio (Admidio) Fixed in 5.0.16

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    admidio 5.0.16

    4 records Highest priority Priority HIGH 1 HIGH, 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-76121 Missing authorization in Admidio exposes inventory data when module is disabledPriority MEDIUM 64
    • TI-2026-76120 Authorization bypass in Admidio list export via pdfl modePriority MEDIUM 57
    • TI-2026-76119 Admidio IDOR lets members edit other users' forum topicsPriority LOW 31
    Show all 4 records →

Timeline

  1. 2026-10-18 Threatist record created from CVE-2026-111916
  2. 2026-10-18 Alias added: GHSA-wwg7-jwv4-c2fh
  3. 2026-10-18 Priority changed: MEDIUM → LOW
  4. 2026-10-21 CISA SSVC decision points changed
  5. 2026-10-21 Priority changed: LOW → HIGH

References

Advisory 1

  • TI-2026-25286 Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion CVSS 3.1CRITICAL 9.1
  • TI-2026-56995 Admidio before 5.0.12 Authentication Bypass via RSS feeds CVSS 4.0HIGH 8.7
  • TI-2026-56993 Admidio before 5.0.12 SQL Injection via relation_type_list CVSS 4.0HIGH 8.7
  • TI-2024-25222 Admidio has Blind SQL Injection in ecard_send.php CVSS 3.1CRITICAL 10.0
  • TI-2026-30186 Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed CVSS 3.1HIGH 8.2
  • TI-2024-25764 Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment CVSS 3.1CRITICAL 9.1
See all 72 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences