CVE-2026-69094 Details

A vulnerability allowing insecure direct object reference has been identified in Admidio versions prior to 5.0.11. This vulnerability resides in the 'save_temporary' mode of 'mylist_function.php', where authenticated users can hijack list configurations. The issue arises because the 'save_temporary' mode does not verify ownership or administrative rights before overwriting list data. As a result, attackers can manipulate global list UUIDs, replacing administrator-managed global lists or other users' private lists by sending a 'list_uuid' parameter. This exploitation transfers ownership of the list to the attacker and demotes the list's status from global to personal, effectively removing it from the visibility of other users.

Users are advised to update Admidio to version 5.0.11 or later, where this vulnerability has been patched.