Description

Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules. Unauthenticated attackers can retrieve forum topics and announcements by sending GET requests to rss/forum.php or rss/announcements.php, disclosing titles, full post text, author names, and timestamps.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-30T15:16:46.607Z",
  "pubdate": "2026-08-30T15:16:46.607Z",
  "executiveSummary": "A broken access control vulnerability exists in Admidio versions prior to 5.0.12, specifically within the forum and announcements modules. This vulnerability allows unauthenticated remote attackers to bypass authorization checks enforced on RSS feed endpoints, leading to unauthorized information disclosure.\nThe vulnerability affects the rss/forum.php and rss/announcements.php files, which fail to validate the session state or authentication status of the requester. By sending crafted GET requests to these endpoints, an attacker can retrieve sensitive internal content that should be restricted to authenticated users. This includes forum topics, full body text of announcements, author identities, and precise timestamps.\nThe risk implication is significant as it facilitates the unauthorized exposure of private communication and metadata, potentially leading to social engineering or reconnaissance. Exploitation requires no special privileges or authentication, as the vulnerable RSS endpoints are publicly accessible via standard web requests. Organizations relying on Admidio for internal community management are exposed to data leakage until the patch is applied.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of access control logic within the Admidio RSS feed generation modules. Specifically, the scripts located at rss/forum.php and rss/announcements.php fail to invoke the necessary authentication verification routines that are typically present in the main application interface. Instead of validating a user's session or specific module permissions, these endpoints directly query the database for content records and render them into an RSS/XML format.\nThe attack flow is straightforward: an attacker identifies the target Admidio instance and locates the vulnerable files at the specified paths. Because the endpoints lack server-side session checks, the application treats incoming HTTP GET requests as legitimate regardless of the source. The attacker does not need to provide any credentials, tokens, or session cookies to retrieve the data.\nUpon receiving a request, the vulnerable script executes SQL queries to fetch data from the forum or announcement tables. The script then proceeds to iterate through the result set and construct an RSS feed response containing titles, full post content, author names, and publication timestamps. This response is returned to the attacker in plain text, effectively bypassing all intended module-level visibility restrictions.\nThis vulnerability is classified as an authorization bypass, where the absence of a 'login-only' requirement on public-facing endpoints results in an insecure direct object reference to the information content. The lack of network segmentation or IP filtering means any entity with internet access can scrape the forum and announcement archives. The post-exploitation impact includes the systematic harvesting of internal metadata and user-generated content, which may violate organizational privacy policies or disclose sensitive internal discussions that were never intended for public consumption.\nAdmidio versions prior to 5.0.12 are confirmed to be susceptible to this flaw. There is no requirement for high-level user interaction, and the attack can be fully automated using simple web scraping tools, curl, or Wget, making it a low-complexity, high-impact vulnerability."
}