A flaw in the ForumService::saveTopic() routine uses an insecure direct object reference that permits any authenticated user to alter the topic_uuid parameter in a topic update request. This enables an attacker to overwrite a victim’s forum topic title and the initial post. While the breach does not give direct access to system files or the ability to execute code, it allows defacement and misinformation within the application’s discussion space, undermining data integrity.

Admindio applications from version 5.0.0 up to and including 5.0.15 are impacted. The official vendors list the vulnerable product as Admindio. All deployments that have not applied the 5.0.16 or later release remain susceptible.

The CVSS base score of 7.1 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers must possess valid user credentials, so the vulnerability is exploitable only by authenticated members of the forum. The lack of remote exploitation requirements and absence of a public exploit reduce the risk to a moderate level, though widespread usage of the application could magnify the impact of content tampering.