Admidio installations older than version 5.0.16 contain a flaw that lets unauthenticated users query the rss/links.php endpoint and receive an RSS feed with weblinks that belong to restricted categories. Because the server does not apply the category_view role visibility filter, the feed reveals link names, URLs, descriptions, categories, and the creators of those links. This exposure of role‑restricted content satisfies the missing authorization weakness identified as CWE‑862.

Admidio community installations running any version earlier than 5.0.16 are susceptible. The affected product is the Admidio application as identified by the CNA authority and the corresponding CPE.

Exploitation requires only an unauthenticated HTTP GET request to the rss/links.php URL. The CVSS score of 6.9 classifies the vulnerability as medium severity, and the lack of any authentication check lowers the attack barrier. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation at present. However, the ease of access and the exposure of privileged data suggest a moderate to high risk for organizations that rely on role‑based visibility for sensitive links.