GitHub Security Advisory (GHSA-rw2j-8c57-x6h2)Vendor advisory
https://github.com/Admidio/admidio/security/advisories/GHSA-rw2j-8c57-x6h2 CVE-2026-69094
MEDIUM
Admidio before 5.0.11 IDOR via save_temporary mylist_function.php
Record summary
CVE-2026-69094 has a selected CVSS score of 5.3 (medium).
Description
Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the save_temporary mode of mylist_function.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' private lists by supplying a list_uuid parameter, transferring ownership and demoting global lists to personal configurations.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 3, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
admidioBrowse Admidio / admidioDefault status: unaffected | CVE List | Before 5.0.11 | affected |
| 5.0.11 | unaffected |
References
3nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-69094 VulnCheck Advisory: Admidio before 5.0.11 IDOR via save_temporary mylist_function.phpThird-party advisory
https://www.vulncheck.com/advisories/admidio-before-idor-via-save-temporary-mylist-function-php