Technology · Packagist
admidio/admidio (Packagist) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 50 vulnerabilities in admidio/admidio (Packagist): 0 in the last 7 days and 1 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-53760, was published on 4 September 2026.
- Last 7 days
- 0
- Last 90 days
- 1
- Critical, all time
- 0
- Exploited in the wild
- 0
About admidio/admidio (Packagist)
Admidio is an open-source user management system for local groups, organizations, and societies.
Latest admidio/admidio (Packagist) vulnerabilities
- CVE-2026-53760: Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles…mediumCVSS 5.2EPSS 0.2%
- CVE-2026-47233: Admidio unauthorized inventory field deletion in inventory modulemediumCVSS 6.5EPSS 0.3%
- CVE-2026-47234: Admidio sensitive information disclosure in application logsmediumCVSS 4.4EPSS 0.2%
- CVE-2026-47232: Admidio CSRF in PKCS#12 private key exportmediumCVSS 4.3EPSS 0.1%
- CVE-2026-47231: Admidio IDOR in documents-files.php move_save handlerhighCVSS 8.1EPSS 0.4%
- CVE-2026-47230: Admidio IDOR in documents-files.php allows unauthorized file renamingmediumCVSS 6.5EPSS 0.3%
- CVE-2026-47229: Admidio CSRF in SSO client enable actionmediumCVSS 5.4EPSS 0.1%
- CVE-2026-47228: Admidio CSRF password reset in registration modulemediumCVSS 5.2EPSS 0.2%
- CVE-2026-47227: Admidio broken authorization in category managementmediumCVSS 6.5EPSS 0.3%
- CVE-2026-47226: Admidio authorization bypass in file_delete handlermediumCVSS 6.5EPSS 0.4%
- CVE-2026-42194: Admidio has an incomplete fix for (SSRF)lowCVSS 3.1EPSS 0.4%
- CVE-2026-41671: Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without ValidationlowCVSS 3.1EPSS 0.4%
- CVE-2026-41670: Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequestlowCVSS 3.1EPSS 0.3%
- CVE-2026-41669: Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequestslowCVSS 3.1EPSS 0.2%
- CVE-2026-41663: Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email SendlowCVSS 3.1EPSS 0.1%
- CVE-2026-41662: Admidio Missing Minimum Administrator Check in Role Membership RemovallowCVSS 3.1EPSS 0.4%
- CVE-2026-41661: Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag ConversionlowCVSS 3.1EPSS 0.3%
- CVE-2026-41660: Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTPlowCVSS 3.1EPSS 0.4%
- CVE-2026-41659: Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member AssignmentlowCVSS 3.1EPSS 0.3%
- CVE-2026-41658: Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete ItemslowCVSS 3.1EPSS 0.3%
- CVE-2026-41657: Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.phplowCVSS 3.1EPSS 0.4%
- CVE-2026-41656: Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File ReadlowCVSS 3.1EPSS 0.4%
- CVE-2026-41655: Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database CredentialslowCVSS 3.1EPSS 0.5%
- CVE-2026-34384: Admidio CSRF in registration approval actionsmediumCVSS 4.5EPSS 0.2%
- CVE-2026-34383: Admidio CSRF and validation bypass in inventory modulemediumCVSS 4.3EPSS 0.1%
Most severe admidio/admidio (Packagist) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-47231: Admidio IDOR in documents-files.php move_save handlerhighCVSS 8.1EPSS 0.4%
- CVE-2026-34381: Admidio improper access control in Docker image document storagehighCVSS 7.5EPSS 0.5%
- CVE-2026-47226: Admidio authorization bypass in file_delete handlermediumCVSS 6.5EPSS 0.4%
- CVE-2026-47227: Admidio broken authorization in category managementmediumCVSS 6.5EPSS 0.3%
- CVE-2026-47233: Admidio unauthorized inventory field deletion in inventory modulemediumCVSS 6.5EPSS 0.3%
- CVE-2026-47230: Admidio IDOR in documents-files.php allows unauthorized file renamingmediumCVSS 6.5EPSS 0.3%
- CVE-2026-47229: Admidio CSRF in SSO client enable actionmediumCVSS 5.4EPSS 0.1%
- CVE-2026-53760: Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles…mediumCVSS 5.2EPSS 0.2%
- CVE-2026-47228: Admidio CSRF password reset in registration modulemediumCVSS 5.2EPSS 0.2%
- CVE-2026-34382: Admidio CSRF in mylist_function.php list deletionmediumCVSS 4.6EPSS 0.1%
Vulnerabilities per week
The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 29 Jun 2026 | 0 | 0 | |
| 6 Jul 2026 | 0 | 0 | |
| 13 Jul 2026 | 0 | 0 | |
| 20 Jul 2026 | 0 | 0 | |
| 27 Jul 2026 | 0 | 0 | |
| 3 Aug 2026 | 0 | 0 | |
| 10 Aug 2026 | 0 | 0 | |
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 1 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 |
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/admidio-admidio.json, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "admidio/admidio (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/admidio-admidio, 26 September 2026.