CVE-2026-111916

Deferred Deferred - Pending Action

Admidio Information Disclosure via RSS Feed

Publication date: 2026-10-17

Last updated on: 2026-10-21

Assigner: VulnCheck

Description

Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because rss/links.php omits the category_view role-visibility filter. Attackers can request the weblinks RSS feed for an organization to retrieve link names, URLs, descriptions, categories, and creator names from restricted LNK categories.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-17

Last Modified

2026-10-21

Generated

2026-11-08

AI Q&A

2026-10-17

EPSS Evaluated

2026-11-07

NVD

CVE-2026-111916

EUVD

EUVD-2026-103305

Affected Vendors & Products

Vendor	Product	Version / Range
Admidio	admidio	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-111916 is an information disclosure vulnerability in Admidio versions before 5.0.16. It allows unauthenticated attackers to view role-restricted weblinks by exploiting a missing role-visibility filter in the RSS feed (rss/links.php). The HTML view applies proper filters but the RSS feed bypasses them, exposing sensitive link details from restricted categories.

Detection Guidance

Check if the weblinks RSS feed is accessible without authentication by accessing /rss/links.php for an organization. If it returns role-restricted links, the vulnerability is present. Use curl to test: curl -v http://<target>/admidio/rss/links.php?org=<org_id>

Verify Admidio version by checking the footer or changelog. Versions 5.0.15 and earlier are vulnerable. Use: grep -r 'Admidio' /var/www/html/admidio/ | grep version

Impact Analysis

Attackers can access restricted weblinks without authentication, potentially exposing sensitive information like link names, URLs, descriptions, categories, and creator names. This could lead to data leaks, unauthorized access to internal resources, or further exploitation if the exposed links contain sensitive endpoints.

Compliance Impact

This vulnerability could violate compliance requirements for data protection regulations like GDPR or HIPAA by exposing sensitive information to unauthorized parties. Organizations using affected Admidio versions may face legal penalties, reputational damage, or audit failures due to inadequate access controls.

Mitigation Strategies

Upgrade Admidio to version 5.0.16 or later immediately to patch the vulnerability. Download the latest version from the official Admidio website or repository.

Temporarily disable the RSS weblinks feed by setting enable_rss=0 in the Admidio configuration file until the upgrade is completed.

Review and restrict access to the /rss/links.php endpoint via web server configuration (e.g., Apache .htaccess or Nginx rules) to block unauthenticated requests.

Hi! I’m here to help you understand CVE-2026-111916. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...