Vulnerability · Published Oct 17, 2026 · Assigned by VulnCheck

CVE-2026-111916Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed

Medium 5.3

In plain English

A medium-severity missing authorization in admidio from Admidio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 71.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because rss/links.php omits the category_view role-visibility filter. Attackers can request the weblinks RSS feed for an organization to retrieve link names, URLs, descriptions, categories, and creator names from restricted LNK categories.

Affected products (as reported)

Vendor	Product	Versions
Admidio	admidio	0 – before 5.0.16

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-552r-jc93-7qr3) vendor-advisory
VulnCheck Advisory: Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed third-party-advisory