CVE-2026-111912 Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update
Authenticated users can modify other users' forum topics by manipulating the topic_uuid parameter, allowing unauthorized data modification.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111912?
CVE-2026-111912 is a high-severity missing authorization vulnerability in admidio, published on 17 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users' forum topics. Attackers can replace the topic_uuid parameter in their own topic_save request, reusing their CSRF token, to overwrite the victim topic's title and first post.
Weakness: CWE-639
Which versions are affected by CVE-2026-111912?
How do I fix CVE-2026-111912?
No fix has been published for CVE-2026-111912 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-111912 being exploited?
There is no known exploitation of CVE-2026-111912 in the wild and no public exploit code.
Sources
Also known as GHSA-8256-4wm7-f628, GHSA-j6q3-mqjq-8j39.