{"id":"CVE-2026-111912","kind":"vulnerability","aliases":["CVE-2026-111912"],"related":[],"title":"Admidio: forum topic IDOR lets members overwrite other users' topics","description":"Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users' forum topics. Attackers can replace the topic_uuid parameter in their own topic_save request, reusing their CSRF token, to overwrite the victim topic's title and first post.","summary":"Admidio versions 5.0.0 before 5.0.16 fail to check ownership in ForumService::saveTopic(), so a logged-in member can change the topic_uuid in their own request. That lets them overwrite another member's forum topic title and first post.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["admidio","package","php","self-hosted"],"not_affected_if":["admidio-5.0.16-or-later","no-forum-use","no-member-accounts"],"how_to_check":"- Check the installed Admidio version in the admin panel or in the `version` file of the install, and see if it is below `5.0.16`.\n- Confirm whether the forum module is enabled and used for member discussions.","fix":"- Upgrade Admidio to `5.0.16` or later.","status":"open","published_at":"2026-10-17T19:16:33+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:36:17+00:00","updated_at":"2026-10-25T03:36:17+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:36:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Admidio to `5.0.16` or later.","reach":"internet","title":"Admidio: forum topic IDOR lets members overwrite other users' topics","impact":"medium","summary":"Admidio versions 5.0.0 before 5.0.16 fail to check ownership in ForumService::saveTopic(), so a logged-in member can change the topic_uuid in their own request. That lets them overwrite another member's forum topic title and first post.","category":"package","nicknames":[],"who_cares":["admidio","self-hosted","php"],"confidence":0.8,"needs_auth":"yes","worst_case":"A member overwrites other members' forum topic titles and first posts.","analyst_note":"","how_to_check":"- Check the installed Admidio version in the admin panel or in the `version` file of the install, and see if it is below `5.0.16`.\n- Confirm whether the forum module is enabled and used for member discussions.","needs_analyst":false,"not_affected_if":["admidio-5.0.16-or-later","no-forum-use","no-member-accounts"],"who_is_affected":"Sites running Admidio 5.0.0 through 5.0.15 with the forum module in use by logged-in members are exposed, since any authenticated member can edit other members' topics. Sites on 5.0.16 or later, or with no member accounts that can post to the forum, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000585,"input_tokens":3336,"output_tokens":503,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111912':13A,16A '-2026':12A,15A '5.0.0':25B,65C '5.0.16':27B,67C 'admidio':1A,17B,23B,63C 'allow':79C 'anoth':54B 'attack':88C 'authent':80C 'chang':42B 'check':30B 'contain':68C 'csrf':103C 'cve':11A,14A 'direct':71C 'fail':28B 'first':61B,113C 'forum':2A,57B,86C 'forumservic':33B,76C 'host':22B 'idor':4A 'insecur':70C 'let':5A,51B 'log':38B 'logged-in':37B 'member':6A,40B,55B,81C 'modifi':83C 'object':72C 'overwrit':7A,53B,106C 'ownership':31B 'packag':18B 'paramet':94C 'php':19B 'post':62B,114C 'refer':73C 'replac':90C 'request':49B,100C 'reus':101C 'save':99C 'savetop':34B,77C 'self':21B 'self-host':20B 'titl':59B,111C 'token':104C 'topic':3A,10A,44B,58B,87C,92C,98C,109C 'user':9A,85C 'uuid':45B,93C 'version':24B 'victim':108C 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Sites running Admidio 5.0.0 through 5.0.15 with the forum module in use by logged-in members are exposed, since any authenticated member can edit other members' topics. Sites on 5.0.16 or later, or with no member accounts that can post to the forum, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111912","severity":null,"published_at":"2026-10-17T19:16:33+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}