CVE-2026-111912: Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-17 · updated 2026-10-19
Weakness: CWE-639

Description

Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users' forum topics. Attackers can replace the topic_uuid parameter in their own topic_save request, reusing their CSRF token, to overwrite the victim topic's title and first post.

Affected products

admidio: from 5.0.0 before 5.0.16 — fixed in 5.0.16

How to fix

Upgrade to a fixed version: admidio 5.0.16. Check the vendor advisory for mitigations.

References

https://github.com/Admidio/admidio/security/advisories/GHSA-8256-4wm7-f628
https://www.vulncheck.com/advisories/admidio-5.0.0-before-5.0.16-idor-via-forum-topic-update

Get alerted when CVE-2026-111912 or the next vulnerability affects your stack