CVE-2026-82655

Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reload_future_memberships endpoint with a victim's user UUID to disclose sensitive membership information.

Admidio before version 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules. Unauthenticated attackers can retrieve forum topics and announcements by sending GET requests to rss/forum.php or rss/announcements.php, disclosing titles, full post text, author names, and timestamps.

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. This can lead to writing files outside the target directory when recipients extract the archive.

Admidio prior to version 5.0.10 has a CSRF vulnerability in the `mode=export` action in `modules/sso/keys.php`, which exports a PKCS#12 bundle with the private key and certificate. The CSRF validation line is commented out, allowing a forged cross-site POST from an administrator session to trigger private key export without a valid form token.

Admidio before version 5.0.10 has a vulnerability in modules/documents-files.php where state-changing modes are gated by checking hasUploadRight() on the URL parameter folder_uuid, but the move_save handler operates on a separate URL parameter file_uuid and calls File::moveToFolder($destFolderUUID). File::moveToFolder() checks the upload right on the destination folder but never on the source folder. As a result, any user who can upload to any single folder can move any file from any other folder, including private folders, into a folder they control, and then download it.

Admidio prior to version 5.0.10 lacks CSRF token validation in `modules/registration.php` in the `send_login` mode. This mode regenerates a random password for `user_uuid_assigned`, stores its bcrypt hash, and emails the cleartext to that user. Other state-changing modes in the same file check the CSRF token, but `send_login` does not. A page visited by a registration-administrator can issue the request as a top-level navigation, and the browser sends the admin's `SameSite=Lax` cookies, allowing password reset without admin interaction.

Admidio prior to version 5.0.10 has a vulnerability in `modules/categories.php` where the per-category permission check is dead code because it compares `$getType` (a category-type code) against mode names (`edit`/`save`/`delete`), which is permanently false. Consequently, the `delete`, `sequence`, and `save` cases load the category by UUID and act on it without re-checking that the category belongs to a module the actor administers. A user with only one module-administrator right can destroy or reorder empty categories belonging to other modules.

Admidio before version 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters (delete and copy). An attacker can trick an authenticated administrator into visiting a crafted URL to delete or duplicate Category Report configurations, affecting the integrity and availability of that module's configuration.

Admidio before version 5.0.11 contains a reflected cross-site scripting vulnerability in the SSO/SAML endpoint. Unauthenticated attackers can inject arbitrary JavaScript via SAML Issuer elements or LightSaml library parameters, enabling session hijacking.

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the configuration state, allowing unauthenticated attackers to read forum topics and posts.