Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: admidio 5.0.11 Clear all filters
TI-2026-48501 CVE-2026-69094 · GHSA-mmp5-653m-6rjv

Admidio before 5.0.11 IDOR via save_temporary mylist_function.php

Priority MEDIUM 57

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the save_temporary mode of mylist_function.php that allows authenticated users to hijack list configurations.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00264 Published 2026-08-03 Fixed in 5.0.11 CWE-639
TI-2026-48500 CVE-2026-69093 · GHSA-xp3j-j2g9-8cmv

Admidio before 5.0.11 CSRF via category-report preferences

Priority MEDIUM 64

Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters (delete and copy).

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00163 Published 2026-08-03 Fixed in 5.0.11 CWE-352
TI-2026-48499 CVE-2026-69092 · GHSA-hpm9-98gj-g9fr

Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint

Priority HIGH 70

Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00376 Published 2026-08-03 Fixed in 5.0.11 CWE-79
TI-2026-48498 CVE-2026-69091 · GHSA-qjhq-374q-29q9

Admidio before 5.0.11 Authentication Bypass via forum.php

Priority MEDIUM 45

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00613 Published 2026-08-03 Fixed in 5.0.11 CWE-306
TI-2026-48497 CVE-2026-69090 · GHSA-jq7q-39fg-c24g

Admidio before 5.0.11 Cross-Organization Role Modification

Priority MEDIUM 64

Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00344 Published 2026-08-03 Fixed in 5.0.11 CWE-862