CVE-2026-69091

HIGH 7.5

Admidio before 5.0.11 Authentication Bypass via forum.php

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by directly accessing the module with read-only parameters.

CWE	CWE-306
Vendor	admidio
Product	admidio
Published	Aug 3, 2026

Stay Ahead of the Next One

Get instant alerts for admidio admidio

Be the first to know when new high vulnerabilities affecting admidio admidio are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

Admidio / admidio

0 < 5.0.11

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Admidio/admidio/security/advisories/GHSA-cf48-6jrq-gjcm vulncheck.com: https://www.vulncheck.com/advisories/admidio-before-authentication-bypass-via-forum-php

Credits

🔍 nuiifornet