# CVE-2026-111912: Admidio forum topic authorization bypass in ForumService::saveTopic()

Source: https://junglewise.ai/threats/cve-2026-111912-admidio-from-5-0-0-before-5-0-16-contains-an-insecure-direct  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-111912 · Severity: medium · CVSS 6.5 · Published 2026-10-17

Admidio is a web-based group management system that includes a discussion forum module. Authenticated forum members can exploit an authorization flaw to modify topics created by other users in the same category, allowing them to alter topic titles and content without permission. This compromises forum content integrity and can be used to deface discussions or spread misinformation.

Technologies: [Admidio](https://junglewise.ai/threats/technologies/admidio). Vendors: [Admidio](https://junglewise.ai/threats/vendors/admidio).

## Quick answers

**Is CVE-2026-111912 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111912 being exploited in the wild.

**How severe is CVE-2026-111912?** Medium severity, with a CVSS score of 6.5, published 17 October 2026.

**Which products and versions are affected?** Admidio 5.0.0 to 5.0.15.

**Is there a fix for CVE-2026-111912?** Yes: fixed in 5.0.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111912 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-111912?** Check whether you run Admidio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.0.16

## Technical details

An insecure direct object reference (IDOR) vulnerability in ForumService::saveTopic() fails to verify topic ownership before allowing updates. Although the UI correctly prevents editing another user's topic, the server-side save endpoint only checks if the attacker can edit the category, not whether they own the specific topic. An authenticated attacker can reuse their own CSRF token and submit a modified topic_uuid parameter to overwrite a victim's topic title and first post.

## Affected products

- Admidio Admidio 5.0.0 to 5.0.15

## Timeline

- 2026-10-02: disclosed
- 2026-10-17: advisory

## References

- [https://github.com/Admidio/admidio/security/advisories/GHSA-8256-4wm7-f628](https://github.com/Admidio/admidio/security/advisories/GHSA-8256-4wm7-f628)
- [https://www.vulncheck.com/advisories/admidio-5.0.0-before-5.0.16-idor-via-forum-topic-update](https://www.vulncheck.com/advisories/admidio-5.0.0-before-5.0.16-idor-via-forum-topic-update)

## Related threats

- [Admidio improper access control in event registration](https://junglewise.ai/threats/cve-2026-117554-admidio-before-5-0-17-contains-an-improper-access-control)
- [Admidio information disclosure in RSS weblinks feed](https://junglewise.ai/threats/cve-2026-111916-admidio-before-5-0-16-contains-an-information-disclosure)
- [Admidio broken access control in inventory module](https://junglewise.ai/threats/cve-2026-111914-admidio-from-5-0-11-before-5-0-16-contains-a-broken-access)
- [Admidio authorization bypass via pdfl export mode](https://junglewise.ai/threats/cve-2026-111913-admidio-from-5-0-0-before-5-0-16-contains-an-authorization)
- [Admidio broken access control in role member assignment](https://junglewise.ai/threats/cve-2026-109329-admidio-4-3-2-through-4-3-17-and-5-0-0-before-5-0-15-contains-a)