{"id":"CVE-2026-111913","kind":"vulnerability","aliases":["CVE-2026-111913"],"related":[],"title":"Admidio: authenticated users bypass export restriction to download member lists","description":"Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl. The groups_roles_export check in modules/groups-roles/lists_show.php omits pdfl, which later runs the pdf export, letting users with list view rights download member lists as PDF files.","summary":"Admidio versions 5.0.0 through 5.0.15 let logged-in users export member lists as PDF by requesting mode=pdfl, skipping the export permission check in lists_show.php. An attacker with list view rights can download member lists they were not supposed to export.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["admidio","package","php","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed Admidio version and see whether it is below `5.0.16`\n- Look for the `groups_roles_export` check and whether `pdfl` is covered in `modules/groups-roles/lists_show.php`","fix":"- Upgrade Admidio to `5.0.16` or later","status":"open","published_at":"2026-10-17T19:16:33+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:26:51+00:00","updated_at":"2026-10-25T04:26:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:26:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Admidio to `5.0.16` or later","reach":"internet","title":"Admidio: authenticated users bypass export restriction to download member lists","impact":"medium","summary":"Admidio versions 5.0.0 through 5.0.15 let logged-in users export member lists as PDF by requesting mode=pdfl, skipping the export permission check in lists_show.php. An attacker with list view rights can download member lists they were not supposed to export.","category":"package","nicknames":[],"who_cares":["admidio","self-hosted","php"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated members download member lists they should not export","analyst_note":"","how_to_check":"- Check the installed Admidio version and see whether it is below `5.0.16`\n- Look for the `groups_roles_export` check and whether `pdfl` is covered in `modules/groups-roles/lists_show.php`","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Any Admidio instance on versions from 5.0.0 before 5.0.16 where users have list view rights can use the PDF export path to download member lists despite export restrictions. Instances on 5.0.16 or later, or on versions older than 5.0.0, are not covered by this entry. unknown whether a non-default configuration is needed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000583,"input_tokens":3349,"output_tokens":496,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111913':13A,16A '-2026':12A,15A '5.0.0':25B,67C '5.0.15':27B '5.0.16':69C 'admidio':1A,17B,23B,65C 'allow':76C 'attack':50B 'authent':2A,77C 'author':72C 'bypass':4A,73C 'check':46B,93C 'contain':70C 'cve':11A,14A 'despit':82C 'download':8A,56B,110C 'export':5A,33B,44B,64B,80C,83C,92C,103C 'file':115C 'group':90C 'host':22B 'later':99C 'let':28B,104C 'list':10A,35B,52B,58B,81C,107C,112C 'lists_show.php':48B 'log':30B 'logged-in':29B 'member':9A,34B,57B,111C 'mode':40B,87C 'modules/groups-roles/lists_show.php':95C 'omit':96C 'packag':18B 'pdf':37B,102C,114C 'pdfl':41B,88C,97C 'permiss':45B 'php':19B 'request':39B,86C 'restrict':6A,84C 'right':54B,109C 'role':91C 'run':100C 'self':21B 'self-host':20B 'skip':42B 'suppos':62B 'user':3A,32B,78C,105C 'version':24B 'view':53B,108C 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Any Admidio instance on versions from 5.0.0 before 5.0.16 where users have list view rights can use the PDF export path to download member lists despite export restrictions. Instances on 5.0.16 or later, or on versions older than 5.0.0, are not covered by this entry. unknown whether a non-default configuration is needed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111913","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111913","severity":null,"published_at":"2026-10-17T19:16:33+00:00","modified_at":"2026-10-19T22:17:04+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}