Live › vulnerability › CVE-2026-111916
Go to dashboardAdmidio before 5.0.16 has an RSS feed endpoint (rss/links.php) that skips the role-visibility check on weblink categories. An unauthenticated attacker can request the weblinks feed and read link names, URLs, descriptions, categories and creator names from categories meant only for certain roles.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organizations running self-hosted Admidio before 5.0.16 that publish weblink categories restricted to specific roles. Installations with no role-restricted weblink categories, or that are not reachable from the internet, have less exposure. Teams on 5.0.16 or later are not affected.
No product ranges from the sources yet.
5.0.16 are affected.rss/links.php) without logging in and see whether links from role-restricted categories appear.5.0.16 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because rss/links.php omits the category_view role-visibility filter. Attackers can request the weblinks RSS feed for an organization to retrieve link names, URLs, descriptions, categories, and creator names from restricted LNK categories.
This page as .md · .json · in your agent: get_signal("CVE-2026-111916")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.