CVE-2026-111912
CVE-2026-111912 · Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users' forum topics. Attackers can replace the topic_uuid parameter in their own topic_save request, reusing their CSRF token, to overwrite the victim topic's title and first post.
CVSS 7.1 · High · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
admidio
- Versions
- ≥ 5.0.0, < 5.0.16: Affected (semver)
- 5.0.16: Not affected (semver)
Update to 5.0.16