CVE-2026-111916: Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed
Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because rss/links.php omits the categoryview role-visibility filter. Attackers can request the weblinks RSS feed for an organization to retrieve link names, URLs, descriptions, categories, and creator names from restricted LNK categories.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Organizations running Admidio versions before 5.0.16 are exposed if they use role-restricted weblink categories. The affected RSS endpoint can disclose content from restricted LNK categories to unauthenticated users.
What does an attacker need to exploit it?
An attacker only needs network access to request the organization's weblinks RSS feed. No authentication, privileges, or user interaction are required.
What information can be disclosed?
The feed can reveal restricted weblink names, URLs, descriptions, categories, and creator names.
How can I tell whether my deployment is affected?
Check whether the Admidio version is earlier than 5.0.16 and whether role-restricted weblink categories exist. Affected deployments may return entries from those restricted categories through rss/links.php without authentication.