CVE-2026-69091: Admidio before 5.0.11 Authentication Bypass via forum.php
Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by directly accessing the module with read-only parameters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Admidioto a version that resolves this vulnerability.Fixed in 5.0.11 - Configuration
If the forum module is configured in login-only mode, ensure the access control logic properly validates that state; otherwise unauthenticated users can read forum topics and posts via direct access to modules/forum.php with read-only parameters (fixed in 5.0.11).
Admidio (modules/forum.php forum module) login-only mode = validated correctly/ensure authentication checks apply
Event History
Frequently Asked Questions
What is the severity of CVE-2026-69091?
The severity of CVE-2026-69091 is high with a score of 7.5.
How do I fix CVE-2026-69091?
To fix CVE-2026-69091, update Admidio to version 5.0.11 or later.
What causes CVE-2026-69091?
CVE-2026-69091 is caused by the failure of access control logic to validate the login-only configuration state.
Who is affected by CVE-2026-69091?
Users of Admidio before version 5.0.11 who have the forum module configured in login-only mode are affected by CVE-2026-69091.
Can CVE-2026-69091 be exploited remotely?
Yes, CVE-2026-69091 can be exploited remotely as it allows unauthenticated attackers to access forum topics and posts.