Admidio versions older than 5.0.11 contain an authentication bypass in the forum module when the system is set to login‑only mode. The permission check in modules/forum.php does not validate the configuration state, allowing any unauthenticated user to request the forum module with read‑only parameters and retrieve forum topics and posts. This flaw is a classic authentication bypass (CWE-306) that provides unauthorized read access to user‑generated content.

The vulnerability affects the Admidio application where the forum module is enabled in login‑only mode, specifically all releases before version 5.0.11. Administrators should verify whether their deployed instance is running a vulnerable version and whether the forum component is active.

The CVSS score of 8.7 indicates a high severity flaw that can lead to significant information disclosure. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog at this time, but the exploit path is straightforward: an attacker simply navigates to forum.php with read‑only parameters without authentication. Given the lack of mitigations in the code, the likelihood of exploitation is considerable for exposed instances.