Authorization Bypass Vulnerability in Admidio Affects Multiple Versions
CVE-2026-111913

5.3MEDIUM

Key Information:

Vendor

Admidio

Status
Admidio
Vendor
CVE Published:
17 October 2026

What is CVE-2026-111913?

An authorization bypass vulnerability exists in Admidio, affecting versions prior to 5.0.16. This flaw allows authenticated users to bypass export restrictions when exporting member lists as PDF files by manipulating the request to include a specific mode parameter, 'pdfl'. The oversight in the groups_roles_export check within the 'lists_show.php' file permits unauthorized access to sensitive data, enabling users with legitimate list view rights to download member lists as PDF documents, thereby compromising user privacy and data integrity.

Affected Version(s)

admidio 5.0.0 < 5.0.16

admidio 5.0.16

References

https://github.com/Admidio/admidio/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/admidio-5.0.0-before...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

euriconicacio
.