Insecure Direct Object Reference Vulnerability in Admidio Product
CVE-2026-69094

5.3MEDIUM

Key Information:

Vendor

Admidio

Status
Admidio
Vendor
CVE Published:
3 August 2026

What is CVE-2026-69094?

Admidio versions before 5.0.11 are impacted by an insecure direct object reference vulnerability located in the save_temporary function of mylist_function.php. This vulnerability permits authenticated users to manipulate list configurations. Specifically, attackers can enumerate global list UUIDs, allowing them to overwrite global lists curated by administrators or even alter other users' private configurations by modifying the list_uuid parameter. This exploitation can lead to unauthorized ownership transfer and misclassification of global lists into personal configurations.

Affected Version(s)

admidio 0 < 5.0.11

admidio 5.0.11

References

https://github.com/Admidio/admidio/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/admidio-before-idor-...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

offset
.