CVE-2026-69091
HIGHAdmidio before 5.0.11 Authentication Bypass via forum.php
Title source: cnaDescription
Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by directly accessing the module with read-only parameters.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-cf48-6jrq-gjcm)
https://github.com/Admidio/admidio/security/advisories/GHSA-cf48-6jrq-gjcm
Third Party Advisory third-party-advisory
VulnCheck Advisory: Admidio before 5.0.11 Authentication Bypass via forum.php
https://www.vulncheck.com/advisories/admidio-before-authentication-bypass-via-forum-php
Scores
CVSS v3
7.5
EPSS
0.0036
EPSS Percentile
28.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-306
Status
published
Products (2)
Admidio/admidio
< 5.0.11
Admidio/admidio
5.0.11
Published
Aug 03, 2026
Tracked Since
Aug 03, 2026