Description
Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl. The groups_roles_export check in modules/groups-roles/lists_show.php omits pdfl, which later runs the pdf export, letting users with list view rights download member lists as PDF files.
Published: 2026-10-17
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authorization Bypass
Action: Apply Patch
AI Analysis

Impact

An authentication check is omitted when users request a PDF export of member lists. The system will perform the export for users who have only list‑view rights, enabling them to download member lists as PDF files, exposing private data beyond the intended permission level.

Affected Systems

Admidio 5.0.0 through 5.0.15 are affected. The vulnerability exists in the groups_roles_export module, which performs list exports.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. EPSS is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers must first authenticate to the application and then request the pdfl mode in lists_show.php to trigger the export. Because the flaw arises from an omitted authorization check, any authenticated user with list view rights can exploit it without needing elevated privileges.

Generated by OpenCVE AI on October 17, 2026 at 21:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Admidio to version 5.0.16 or later, which includes the proper check for PDF export mode.
  • If an upgrade is not immediately possible, restrict export permissions or disable the PDF export functionality for users with list view rights by configuring the application or editing the groups_roles_export code to reject the pdfl mode.
  • Enable auditing of export requests and monitor for unexpected PDF exports, and review user permissions to ensure only authorized accounts have export rights.

Generated by OpenCVE AI on October 17, 2026 at 21:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl. The groups_roles_export check in modules/groups-roles/lists_show.php omits pdfl, which later runs the pdf export, letting users with list view rights download member lists as PDF files.
Title Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php
First Time appeared Admidio
Admidio admidio
Weaknesses CWE-285
CPEs cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*
Vendors & Products Admidio
Admidio admidio
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Admidio Admidio
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-17T18:46:30.372Z

Reserved: 2026-10-17T12:18:55.462Z

Link: CVE-2026-111913

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-17T19:16:33.823

Modified: 2026-10-17T19:16:33.823

Link: CVE-2026-111913

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T21:45:14Z

Weaknesses