Vulnerability · Published Oct 17, 2026 · Assigned by VulnCheck
CVE-2026-111913Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php
Medium 4.3
In plain English
A medium-severity security flaw in admidio from Admidio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.2%top 86.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl. The groups_roles_export check in modules/groups-roles/lists_show.php omits pdfl, which later runs the pdf export, letting users with list view rights download member lists as PDF files.
Affected products (as reported)
Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Security Advisory (GHSA-86f5-rg96-frrj) vendor-advisory
- VulnCheck Advisory: Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php third-party-advisory