Executive brief
Admidio is an open-source membership and organization management platform with community forums and announcements features. When administrators configure these features as login-only, unauthenticated attackers can bypass this restriction via RSS feeds, exposing forum topics, announcements, author names, and timestamps that should be hidden from unauthorized users.
Technical details
Admidio fails to enforce login-only module restrictions (mode 2) in RSS feed endpoints rss/forum.php and rss/announcements.php. The vulnerability exists because these endpoints check only whether the module is disabled (mode 0) but do not validate whether the requesting user is authenticated when the module is set to login-only (mode 2). The interactive module pages (modules/forum.php and modules/announcements.php) correctly enforce the login requirement, but the corresponding RSS service classes (ForumService::rssFeed() and AnnouncementsService::rssFeed()) lack this authentication gate. An unauthenticated attacker can send a simple GET request to rss/forum.php or rss/announcements.php to retrieve all forum topics and announcements from categories without explicit view-role restrictions. The vulnerability was introduced because a prior patch (CVE-2026-cf48) fixed the interactive module authentication but left the RSS feeds unpatched. A fix was released in version 5.0.12.
Affected products
- Admidio Admidio before 5.0.12
Timeline
- 2026-08-16: disclosed: GitHub Security Advisory GHSA-mg9h-42f8-2pmm published
- 2026-08-30: advisory: CVE-2026-82657 published on NVD
- 2026-08-30: patched: Fixed in version 5.0.12