CVE-2026-111913: Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php
Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl. The groupsrolesexport check in modules/groups-roles/listsshow.php omits pdfl, which later runs the pdf export, letting users with list view rights download member lists as PDF files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Admidioto a version that resolves this vulnerability.Fixed in 5.0.16
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated and have permission to view the relevant lists. They do not need the separate export permission because the pdfl mode bypasses the groups_roles_export check.
What information can be exposed?
Affected users can download member lists as PDF files, even where export restrictions are intended to prevent them from exporting those lists.
Which versions are affected?
Admidio versions from 5.0.0 before 5.0.16 are affected. Version 5.0.16 is outside the affected range.
How can I check for attempted exploitation?
Review requests to modules/groups-roles/lists_show.php for mode=pdfl, particularly when made by users who have list-view rights but should not have export permission.