Admidio is Missing Authorization on Forum Topic and Post Deletion

Vulnerability

Description

CVE-2026-32818 is a missing authorization vulnerability in the forum module of Admidio, an open-source user management system. In versions 5.0.0 through 5.0.6, the topic_delete and post_delete actions in forum.php actions validate only the CSRF token but never call the isEditable() or isEditable()` methods that check administrator status or ownership. This means any authenticated user with forum access can permanently delete any forum topic (including all its posts) or any individual post by providing its UUID [1][2].

Exploitation

An attacker needs only a valid login and knowledge of the target's UUID, which is publicly visible in URLs. No special privileges are required beyond basic forum access. The delete operations are triggered via POST requests with a valid CSRF token, but since the token is tied to the session and can be obtained from the page, the attack is straightforward [2]. The save/edit operations in the same module properly enforce isAdministratorForum() and ownership checks, making the inconsistency in the delete path the core flaw [1][2].

Impact

Successful exploitation results in irreversible loss of forum content. An attacker can delete any topic (and all its posts) or any individual post, potentially disrupting community discussions, removing important announcements, or causing data loss. The deletion is permanent and cannot be undone through the application interface [1][2].

Mitigation

The issue has been fixed in Admidio version 5.0.7, released on 2026-03-19. Users are strongly recommended to upgrade immediately. No workarounds are documented; the fix adds proper authorization checks to the delete handlers [1][4].