Admidio: Four Vulnerabilities Including SQLi and Access Control Flaws Disclosed Together
Four Admidio vulnerabilities, including two high-severity flaws, were disclosed on August 30, 2026, impacting access control and data exposure.
Key findings
- Four Admidio vulnerabilities disclosed on August 30, 2026, patched in version 5.0.12.
- Two high-severity flaws include unauthenticated RSS feed data exposure and blind SQL injection.
- Medium severity broken access control allows reading future role memberships.
- Low severity path traversal in photo ZIP downloads.
On August 30, 2026, a batch of four vulnerabilities was disclosed for Admidio, a web-based open-source software for user and member administration. The vulnerabilities, all patched in version 5.0.12, include two high-severity flaws, one medium, and one low. These issues collectively impact access control, data exposure, and file integrity within the Admidio platform.
One of the high-severity vulnerabilities, CVE-2026-82657, is a failure to enforce login-only restrictions for RSS feed endpoints. This allows unauthenticated attackers to access forum topics and announcements, potentially exposing sensitive information such as titles, full post text, and author names.
Another high-severity flaw, CVE-2026-82655, is a blind SQL injection vulnerability in the lists_show.php script. Exploitable by unauthenticated attackers, this flaw allows for the execution of arbitrary SQL queries through the relation_type_list parameter, potentially leading to data exfiltration.
A medium-severity vulnerability, CVE-2026-82658, stems from a broken access control issue in profile_function.php. Authenticated users with low privileges can exploit this to view another user's future role memberships by directly calling the reload_future_memberships endpoint.
Finally, a low-severity vulnerability, CVE-2026-82656, involves improper sanitization of album names in the photo ZIP download feature. This allows authenticated users with album creation rights to use path traversal sequences in album names, potentially leading to unintended file access outside the intended directory.
All identified vulnerabilities were addressed in Admidio version 5.0.12. Users are strongly advised to update to this version to mitigate the risks associated with these security flaws.
This batch of vulnerabilities highlights the importance of robust access control and input sanitization in web applications. The disclosure of both unauthenticated and authenticated vulnerabilities underscores the need for continuous security vigilance and timely patching for all Admidio users.