Is CVE-2026-82657 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82657 being exploited in the wild.

How severe is CVE-2026-82657?

High severity, with a CVSS score of 7.5, published 30 August 2026.

Is there a fix for CVE-2026-82657?

A patch was published on 2026-08-30: Fixed in version 5.0.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82657 attacked?

It is attacked over the network.

Am I affected by CVE-2026-82657?

Check whether you run Admidio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82657: Admidio RSS feed authentication bypass in forum and announcements

CVE-2026-82657 · Severity: high · CVSS 7.5 · Published 2026-08-30

Admidio is an open-source membership and organization management platform with community forums and announcements features. When administrators configure these features as login-only, unauthenticated attackers can bypass this restriction via RSS feeds, exposing forum topics, announcements, author names, and timestamps that should be hidden from unauthorized users.

Technologies: Admidio. Vendors: Admidio.

Quick answers

Is CVE-2026-82657 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82657 being exploited in the wild.
How severe is CVE-2026-82657?: High severity, with a CVSS score of 7.5, published 30 August 2026.
Which products and versions are affected?: Admidio before 5.0.12.
Is there a fix for CVE-2026-82657?: A patch was published on 2026-08-30: Fixed in version 5.0.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82657 attacked?: It is attacked over the network.
Am I affected by CVE-2026-82657?: Check whether you run Admidio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Admidio fails to enforce login-only module restrictions (mode 2) in RSS feed endpoints rss/forum.php and rss/announcements.php. The vulnerability exists because these endpoints check only whether the module is disabled (mode 0) but do not validate whether the requesting user is authenticated when the module is set to login-only (mode 2). The interactive module pages (modules/forum.php and modules/announcements.php) correctly enforce the login requirement, but the corresponding RSS service classes (ForumService::rssFeed() and AnnouncementsService::rssFeed()) lack this authentication gate. An unauthenticated attacker can send a simple GET request to rss/forum.php or rss/announcements.php to retrieve all forum topics and announcements from categories without explicit view-role restrictions. The vulnerability was introduced because a prior patch (CVE-2026-cf48) fixed the interactive module authentication but left the RSS feeds unpatched. A fix was released in version 5.0.12.

Affected products

Admidio Admidio before 5.0.12

Timeline

2026-08-16: disclosed: GitHub Security Advisory GHSA-mg9h-42f8-2pmm published
2026-08-30: advisory: CVE-2026-82657 published on NVD
2026-08-30: patched: Fixed in version 5.0.12

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.