CVE-2026-32818 Admidio is Missing Authorization on Forum Topic and Post Deletion
Any authenticated user can permanently delete any forum topic or post in Admidio by bypassing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32818?
CVE-2026-32818 is a medium-severity missing authorization vulnerability in admidio, published on 19 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the forum module in Admidio does not verify whether the current user has permission to delete forum topics or posts. Both the topic_delete and post_delete actions in forum.php only validate the CSRF token but perform no authorization check before calling delete(). Any authenticated user with forum access can delete any topic (with all its posts) or any individual post by providing its UUID. This is inconsistent with the save/edit operations, which properly check isAdministratorForum() and ownership before allowing modifications. Any logged-in user can permanently and irreversibly delete any forum topic (including all its posts) or any individual post by simply knowing its UUID (which is publicly visible in URLs), completely bypassing authorization checks. This issue has been fixed in version 5.0.7.
Weakness: CWE-862
Which versions are affected by CVE-2026-32818?
2 open source packages ship an affected version, including admidio/admidio. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
admidio/admidio Packagist | From 5.0.0 | 5.0.7 |
admidio/admidio Packagist | From 5.0.0 | 5.0.7 |
Products include Admidio Admidio.
How do I fix CVE-2026-32818?
Upgrade admidio/admidio to 5.0.7 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-32818 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32818 exists.
Other vulnerabilities in admidio
- CVE-2024-37906 Admidio has Blind SQL Injection in ecard_send.php
- CVE-2021-32630 Various
- CVE-2026-32817 Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
- CVE-2024-38529 Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment
- CVE-2026-32756 Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module
Sources
Also known as GHSA-g375-5wmp-xr78.