Technology · Packagist
admidio/admidio (Packagist) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 50 vulnerabilities in admidio/admidio (Packagist): 0 in the last 7 days and 1 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-53760, was published on 4 September 2026. Nothing was published in the last eight weeks.
- Last 7 days
- 0
- Last 90 days
- 1
- Critical, all time
- 0
- Exploited in the wild
- 0
About admidio/admidio (Packagist)
Admidio is an open-source user management system for local groups, organizations, and societies.
Latest admidio/admidio (Packagist) vulnerabilities
- CVE-2026-53760: Admidio CSRF in plugin management modulemediumCVSS 5.2EPSS 0.2%
- CVE-2026-47233: Admidio unauthorized inventory field deletion in inventory modulemediumCVSS 6.5EPSS 0.3%
- CVE-2026-47234: Admidio sensitive information disclosure in application logsmediumCVSS 4.4EPSS 0.2%
- CVE-2026-47232: Admidio CSRF in PKCS#12 private key exportmediumCVSS 4.3EPSS 0.1%
- CVE-2026-47231: Admidio IDOR in documents-files.php move_save handlerhighCVSS 8.1EPSS 0.4%
- CVE-2026-47230: Admidio IDOR in documents-files.php allows unauthorized file renamingmediumCVSS 6.5EPSS 0.3%
- CVE-2026-47229: Admidio CSRF in SSO client enable actionmediumCVSS 5.4EPSS 0.1%
- CVE-2026-47228: Admidio CSRF password reset in registration modulemediumCVSS 5.2EPSS 0.2%
- CVE-2026-47227: Admidio broken authorization in category managementmediumCVSS 6.5EPSS 0.3%
- CVE-2026-47226: Admidio authorization bypass in file_delete handlermediumCVSS 6.5EPSS 0.4%
- CVE-2026-42194: Admidio has an incomplete fix for (SSRF)lowCVSS 3.1EPSS 0.4%
- CVE-2026-41671: Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without ValidationlowCVSS 3.1EPSS 0.4%
- CVE-2026-41670: Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequestlowCVSS 3.1EPSS 0.3%
- CVE-2026-41669: Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequestslowCVSS 3.1EPSS 0.2%
- CVE-2026-41663: Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email SendlowCVSS 3.1EPSS 0.1%
- CVE-2026-41662: Admidio Missing Minimum Administrator Check in Role Membership RemovallowCVSS 3.1EPSS 0.4%
- CVE-2026-41661: Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag ConversionlowCVSS 3.1EPSS 0.3%
- CVE-2026-41660: Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTPlowCVSS 3.1EPSS 0.4%
- CVE-2026-41659: Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member AssignmentlowCVSS 3.1EPSS 0.3%
- CVE-2026-41658: Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete ItemslowCVSS 3.1EPSS 0.3%
- CVE-2026-41657: Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.phplowCVSS 3.1EPSS 0.4%
- CVE-2026-41656: Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File ReadlowCVSS 3.1EPSS 0.4%
- CVE-2026-41655: Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database CredentialslowCVSS 3.1EPSS 0.5%
- CVE-2026-34384: Admidio CSRF in registration approval actionsmediumCVSS 4.5EPSS 0.2%
- CVE-2026-34383: Admidio CSRF and validation bypass in inventory modulemediumCVSS 4.3EPSS 0.1%
Most severe admidio/admidio (Packagist) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-47231: Admidio IDOR in documents-files.php move_save handlerhighCVSS 8.1EPSS 0.4%
- CVE-2026-34381: Admidio improper access control in Docker image document storagehighCVSS 7.5EPSS 0.5%
- CVE-2025-62617: Admidio Vulnerable to Authenticated SQL Injection in Member Assignment FunctionalityhighCVSS 7.2EPSS 0.4%
- CVE-2026-47226: Admidio authorization bypass in file_delete handlermediumCVSS 6.5EPSS 0.4%
- CVE-2026-47227: Admidio broken authorization in category managementmediumCVSS 6.5EPSS 0.3%
- CVE-2026-47233: Admidio unauthorized inventory field deletion in inventory modulemediumCVSS 6.5EPSS 0.3%
- CVE-2026-47230: Admidio IDOR in documents-files.php allows unauthorized file renamingmediumCVSS 6.5EPSS 0.3%
- CVE-2026-47229: Admidio CSRF in SSO client enable actionmediumCVSS 5.4EPSS 0.1%
- CVE-2026-53760: Admidio CSRF in plugin management modulemediumCVSS 5.2EPSS 0.2%
- CVE-2026-47228: Admidio CSRF password reset in registration modulemediumCVSS 5.2EPSS 0.2%
Vulnerabilities per week
Nothing was published in the last eight weeks. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 1 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many admidio/admidio (Packagist) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/admidio-admidio)<a href="https://junglewise.ai/threats/technologies/admidio-admidio"><img src="https://junglewise.ai/threats/technologies/admidio-admidio/badge.svg" alt="admidio/admidio (Packagist) vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/admidio-admidio.json, and this page as text at https://junglewise.ai/threats/technologies/admidio-admidio.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "admidio/admidio (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/admidio-admidio, 9 November 2026.