# CVE-2026-82657: Admidio RSS feed authentication bypass in forum and announcements

Source: https://junglewise.ai/threats/cve-2026-82657-admidio-rss-feed-authentication-bypass-in-forum-and-announcements  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-30. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82657 · Severity: high · CVSS 7.5 · Published 2026-08-30

Admidio is an open-source membership and organization management platform with community forums and announcements features. When administrators configure these features as login-only, unauthenticated attackers can bypass this restriction via RSS feeds, exposing forum topics, announcements, author names, and timestamps that should be hidden from unauthorized users.

Technologies: [Admidio](https://junglewise.ai/threats/technologies/admidio). Vendors: [Admidio](https://junglewise.ai/threats/vendors/admidio).

## Quick answers

**Is CVE-2026-82657 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82657 being exploited in the wild.

**How severe is CVE-2026-82657?** High severity, with a CVSS score of 7.5, published 30 August 2026.

**Which products and versions are affected?** Admidio before 5.0.12.

**Is there a fix for CVE-2026-82657?** A patch was published on 2026-08-30: Fixed in version 5.0.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82657 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-82657?** Check whether you run Admidio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Admidio fails to enforce login-only module restrictions (mode 2) in RSS feed endpoints rss/forum.php and rss/announcements.php. The vulnerability exists because these endpoints check only whether the module is disabled (mode 0) but do not validate whether the requesting user is authenticated when the module is set to login-only (mode 2). The interactive module pages (modules/forum.php and modules/announcements.php) correctly enforce the login requirement, but the corresponding RSS service classes (ForumService::rssFeed() and AnnouncementsService::rssFeed()) lack this authentication gate. An unauthenticated attacker can send a simple GET request to rss/forum.php or rss/announcements.php to retrieve all forum topics and announcements from categories without explicit view-role restrictions. The vulnerability was introduced because a prior patch (CVE-2026-cf48) fixed the interactive module authentication but left the RSS feeds unpatched. A fix was released in version 5.0.12.

## Affected products

- Admidio Admidio before 5.0.12

## Timeline

- 2026-08-16: disclosed: GitHub Security Advisory GHSA-mg9h-42f8-2pmm published
- 2026-08-30: advisory: CVE-2026-82657 published on NVD
- 2026-08-30: patched: Fixed in version 5.0.12

## References

- [https://github.com/Admidio/admidio/security/advisories/GHSA-mg9h-42f8-2pmm](https://github.com/Admidio/admidio/security/advisories/GHSA-mg9h-42f8-2pmm)
- [https://www.vulncheck.com/advisories/admidio-before-5.0.12-authentication-bypass-via-rss-feeds](https://www.vulncheck.com/advisories/admidio-before-5.0.12-authentication-bypass-via-rss-feeds)

## Related threats

- [Admidio improper access control in event registration](https://junglewise.ai/threats/cve-2026-117554-admidio-before-5-0-17-contains-an-improper-access-control)
- [Admidio information disclosure in RSS weblinks feed](https://junglewise.ai/threats/cve-2026-111916-admidio-before-5-0-16-contains-an-information-disclosure)
- [Admidio broken access control in inventory module](https://junglewise.ai/threats/cve-2026-111914-admidio-from-5-0-11-before-5-0-16-contains-a-broken-access)
- [Admidio authorization bypass via pdfl export mode](https://junglewise.ai/threats/cve-2026-111913-admidio-from-5-0-0-before-5-0-16-contains-an-authorization)
- [Admidio forum topic authorization bypass in ForumService::saveTopic()](https://junglewise.ai/threats/cve-2026-111912-admidio-from-5-0-0-before-5-0-16-contains-an-insecure-direct)