Live › vulnerability › CVE-2026-111913
Go to dashboardAdmidio versions 5.0.0 through 5.0.15 let logged-in users export member lists as PDF by requesting mode=pdfl, skipping the export permission check in lists_show.php. An attacker with list view rights can download member lists they were not supposed to export.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any Admidio instance on versions from 5.0.0 before 5.0.16 where users have list view rights can use the PDF export path to download member lists despite export restrictions. Instances on 5.0.16 or later, or on versions older than 5.0.0, are not covered by this entry. unknown whether a non-default configuration is needed.
No product ranges from the sources yet.
5.0.16groups_roles_export check and whether pdfl is covered in modules/groups-roles/lists_show.php5.0.16 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl. The groups_roles_export check in modules/groups-roles/lists_show.php omits pdfl, which later runs the pdf export, letting users with list view rights download member lists as PDF files.
This page as .md · .json · in your agent: get_signal("CVE-2026-111913")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.