Live › vulnerability › CVE-2026-111912
Go to dashboardAdmidio versions 5.0.0 before 5.0.16 fail to check ownership in ForumService::saveTopic(), so a logged-in member can change the topic_uuid in their own request. That lets them overwrite another member's forum topic title and first post.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Admidio 5.0.0 through 5.0.15 with the forum module in use by logged-in members are exposed, since any authenticated member can edit other members' topics. Sites on 5.0.16 or later, or with no member accounts that can post to the forum, can skip it.
No product ranges from the sources yet.
version file of the install, and see if it is below 5.0.16.5.0.16 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users' forum topics. Attackers can replace the topic_uuid parameter in their own topic_save request, reusing their CSRF token, to overwrite the victim topic's title and first post.
This page as .md · .json · in your agent: get_signal("CVE-2026-111912")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.