CVE-2026-69091 Details
Description
Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by directly accessing the module with read-only parameters.
An authentication bypass vulnerability has been identified in the Admidio forum module, versions prior to 5.0.11, when it is set to login-only mode. The issue arises in the access control logic of 'modules/forum.php', which fails to properly validate the login-only configuration. This oversight allows unauthenticated attackers to access and read forum topics and posts by directly interacting with the module using read-only parameters. In contrast, other modules within the same application correctly enforce this access control.
To address this vulnerability, update Admidio to version 5.0.11 or later. Additionally, the missing authentication check should be added to 'modules/forum.php' to ensure proper access control.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 3, 2026CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Admidio/admidio/security/advisories/GHSA-cf48-6jrq-gjcm | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/admidio-before-authentication-bypass-via-forum-php | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Admidio | <= 5.0.11 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | New CVE Received | [email protected] |