Admidio versions 5.0.0 through 5.0.6 allow any authenticated user with forum access to permanently delete any forum topic or individual post by supplying its UUID. The module only verifies a CSRF token before deletion, performing no authorization check, which means users can irreversibly remove content they should not be able to alter, undermining the integrity of the discussion data.

The vulnerability affects the Admidio user management solution, specifically the forum module in releases 5.0.0 up to 5.0.6. Administrators and ordinary users with forum privileges can trigger deletions; the issue is resolved in version 5.0.7 and later.

The CVSS score of 6.5 indicates medium severity, and the EPSS score of less than 1% suggests low overall exploitation probability. Because any authenticated user can delete content by knowing a visible UUID, the threat vector is authenticated web access; no privileged escalation is required. The vulnerability is not listed in CISA's KEV catalog. While the risk to confidentiality is minimal, the potential for irreversible data loss and loss of forum integrity makes it a significant operational concern.