CVE-2026-82657: Admidio before 5.0.12 Authentication Bypass via RSS feeds
Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules. Unauthenticated attackers can retrieve forum topics and announcements by sending GET requests to rss/forum.php or rss/announcements.php, disclosing titles, full post text, author names, and timestamps.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Admidioto a version that resolves this vulnerability.Fixed in 5.0.12
Event History
Frequently Asked Questions
Who is exposed to this issue?
Admidio deployments running versions before 5.0.12 are exposed when the forum or announcements modules are configured as login-only. The affected RSS endpoints can disclose content from those modules without authentication.
What does an attacker need to exploit it?
An attacker needs only network access to the Admidio instance and can send unauthenticated GET requests to rss/forum.php or rss/announcements.php. No credentials or user interaction are required.
What information can be disclosed?
The affected endpoints may expose forum topics and announcements, including titles, full post text, author names, and timestamps.
How can I check whether my instance is affected?
On an Admidio version before 5.0.12, test rss/forum.php and rss/announcements.php without logging in. If either endpoint returns content from a module restricted to logged-in users, the instance is affected.