Is CVE-2026-111912 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111912 being exploited in the wild.

How severe is CVE-2026-111912?

Medium severity, with a CVSS score of 6.5, published 17 October 2026.

Is there a fix for CVE-2026-111912?

Yes: fixed in 5.0.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-111912 attacked?

It is attacked over the network.

Am I affected by CVE-2026-111912?

Check whether you run Admidio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111912: Admidio forum topic authorization bypass in ForumService::saveTopic()

CVE-2026-111912 · Severity: medium · CVSS 6.5 · Published 2026-10-17

Admidio is a web-based group management system that includes a discussion forum module. Authenticated forum members can exploit an authorization flaw to modify topics created by other users in the same category, allowing them to alter topic titles and content without permission. This compromises forum content integrity and can be used to deface discussions or spread misinformation.

Technologies: Admidio. Vendors: Admidio.

Quick answers

Is CVE-2026-111912 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111912 being exploited in the wild.
How severe is CVE-2026-111912?: Medium severity, with a CVSS score of 6.5, published 17 October 2026.
Which products and versions are affected?: Admidio 5.0.0 to 5.0.15.
Is there a fix for CVE-2026-111912?: Yes: fixed in 5.0.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111912 attacked?: It is attacked over the network.
Am I affected by CVE-2026-111912?: Check whether you run Admidio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.0.16

Technical details

An insecure direct object reference (IDOR) vulnerability in ForumService::saveTopic() fails to verify topic ownership before allowing updates. Although the UI correctly prevents editing another user's topic, the server-side save endpoint only checks if the attacker can edit the category, not whether they own the specific topic. An authenticated attacker can reuse their own CSRF token and submit a modified topic_uuid parameter to overwrite a victim's topic title and first post.

Affected products

Admidio Admidio 5.0.0 to 5.0.15

Timeline

2026-10-02: disclosed
2026-10-17: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.