CVE-2026-111912: Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update
Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users' forum topics. Attackers can replace the topicuuid parameter in their own topicsave request, reusing their CSRF token, to overwrite the victim topic's title and first post.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Admidioto a version that resolves this vulnerability.Fixed in 5.0.16
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Admidio member can exploit it. The attacker needs to be able to submit a forum topic update request and reuse the CSRF token from their own request.
What does an attacker need to change to target another member's topic?
The attacker can replace the topic_uuid parameter in their own topic_save request with the UUID of a victim's topic. This can overwrite the victim topic's title and first post.
Which deployments are affected?
Admidio versions from 5.0.0 through versions before 5.0.16 are affected. Version 5.0.16 is not listed as affected.