Admidio vulnerabilities
We track 15 vulnerabilities in Admidio products. 15 are rated high or critical, and none are known to be exploited. The most recent was published on August 30, 2026.
Latest Admidio vulnerabilities
- 7.5 High severity
admidio: Exposure of Sensitive Information to an Unauthorized Actor
Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules. Unauthenticated attackers can retrieve forum topics and announcements by sending GET requests to rss/forum.php or rss/announcements
- 7.5 High severity
admidio: Improper Neutralization of Special Elements used in an SQL Command
Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation_type_list parameter of lists_show.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can bypass authentication by providing a dummy UUID in ro
- 8.1 High severity
admidio: Authorization Bypass Through User-Controlled Key
Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` gates state-changing modes by checking that the actor has `hasUploadRight()` on the URL parameter `folder_uuid`. The `move_save` handler then operates on
- 7.5 High severity
admidio: Missing Authentication for Critical Functionality
Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers
- 8.2 High severity
Admidio is an open-source user management solution.
Admidio is an open-source user management solution. Prior to version 5.0.9, the SAML IdP implementation in Admidio's SSO module uses the AssertionConsumerServiceURL value directly from incoming SAML AuthnRequest messages as the destination for the SAML respons
- 8.2 High severity
admidio: Improper Verification of Cryptographic Signature
Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio SAML Identity Provider implementation discards the return value of its validateSignature() method at both call sites (handleSSORequest() line 418 and handleSLORequest() lin
- 7.1 High severity
admidio: Incorrect Authorization
Admidio is an open-source user management solution. Prior to version 5.0.9, a logic error in Admidio's two-factor authentication reset inverts the authorization check. Non-admin users cannot remove their own TOTP configuration, but they can remove other users'
- 7.3 High severity
admidio: Cross-Site Request Forgery
Admidio is an open-source user management solution. Prior to version 5.0.8, the create_user, assign_member, and assign_user action modes in modules/registration.php approve pending user registrations via GET request without validating a CSRF token. Unlike the
- 7.5 High severity
admidio: Improper Access Control
Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, Admidio relies on adm_my_files/.htaccess to deny direct HTTP access to uploaded documents. The Docker image ships with AllowOverride None in the Apache configuratio
- 9.1 Critical severity
admidio: Missing Authorization
Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the documents and files module does not verify whether the current user has permission to delete folders or files. The folder_delete and file_delete action handlers in modules
- 8.0 High severity
admidio: Improper Neutralization of Special Elements used in an SQL Command
Admidio is an open-source user management solution. Versions 5.0.6 and below are vulnerable to arbitrary SQL Injection through the MyList configuration feature. The MyList configuration feature lets authenticated users define custom list column layouts, storin
- 8.8 High severity
admidio: Unrestricted Upload of File with Dangerous Type
Admidio is an open-source user management solution. Versions 5.0.6 and below contain a critical unrestricted file upload vulnerability in the Documents & Files module. Due to a design flaw in how CSRF token validation and file extension verification interact w
- 7.2 High severity
admidio: Improper Neutralization of Special Elements used in an SQL Command
Admidio is an open-source user management solution. Prior to version 4.3.17, an authenticated SQL injection vulnerability exists in the member assignment data retrieval functionality of Admidio. Any authenticated user with permissions to assign members to a ro
- 8.8 High severity
admidio: Unrestricted Upload of File with Dangerous Type
Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.10, there is a Remote Code Execution Vulnerability in the Message module of the Admidio Application, where it is possible to upload a
- 8.8 High severity
admidio: Improper Neutralization of Special Elements used in an SQL Command
Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.9, there is an SQL Injection in the `/adm_program/modules/ecards/ecard_send.php` source file of the Admidio Application. The SQL Injec