CVE-2026-111913

Deferred Deferred - Pending Action

Authorization Bypass in Admidio via PDF Export

Publication date: 2026-10-17

Last updated on: 2026-10-19

Assigner: VulnCheck

Description

Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl. The groups_roles_export check in modules/groups-roles/lists_show.php omits pdfl, which later runs the pdf export, letting users with list view rights download member lists as PDF files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-17

Last Modified

2026-10-19

Generated

2026-11-08

AI Q&A

2026-10-17

EPSS Evaluated

2026-11-07

NVD

CVE-2026-111913

EUVD

EUVD-2026-103307

Affected Vendors & Products

Vendor	Product	Version / Range
Admidio	admidio	5.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-111913 is an authorization bypass vulnerability in Admidio versions 5.0.0 to 5.0.15. It allows authenticated users with list view rights to export member lists as PDF files even when export restrictions are in place. The flaw occurs because the permission check in lists_show.php omits the 'pdfl' mode, which later converts to 'pdf' and bypasses access controls.

Detection Guidance

Check Admidio version with: grep -r 'version' /path/to/admidio. If version is between 5.0.0 and 5.0.15, the system is vulnerable. Inspect modules/groups-roles/lists_show.php for missing 'pdfl' in permission checks at line 215.

Test by attempting to export a list with mode=pdfl. If successful without proper permissions, the vulnerability is present.

Impact Analysis

This vulnerability allows unauthorized users to download sensitive member lists as PDF files, bypassing intended export restrictions. While it does not expose additional confidential data beyond what users can already view, it undermines policy enforcement and could lead to unauthorized data collection.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized access to sensitive member data, potentially violating data protection requirements such as GDPR or HIPAA. It undermines access controls designed to protect personal information, increasing the risk of regulatory penalties.

Mitigation Strategies

Upgrade Admidio to version 5.0.16 or later immediately to patch the authorization bypass.

Temporarily restrict access to the lists_show.php file or disable PDF export functionality until patched.

Review audit logs for unauthorized PDF export attempts and revoke any suspicious user permissions.

Hi! I’m here to help you understand CVE-2026-111913. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...