Insecure Direct Object Reference in Admidio Forum Service
CVE-2026-111912

7.1HIGH

Key Information:

Vendor

Admidio

Status
Admidio
Vendor
CVE Published:
17 October 2026

What is CVE-2026-111912?

Admidio versions prior to 5.0.16 are susceptible to an insecure direct object reference vulnerability in the ForumService::saveTopic() method. This flaw enables authenticated users to modify the topics of other users. By manipulating the 'topic_uuid' parameter during their own topic save requests, attackers can overwrite existing forum entries, including the title and initial content of a victim's topic, by reusing their CSRF token. Proper access control measures should be implemented to prevent unauthorized topic alterations.

Affected Version(s)

admidio 5.0.0 < 5.0.16

admidio 5.0.16

References

https://github.com/Admidio/admidio/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/admidio-5.0.0-before...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

J0hnathanKim
t-211
choewonwoo1817
garry15907
gwangwon0807
Kamba-netizen
xo0102
.