CVE-2026-69091
Received Received - Intake

Authentication Bypass in Admidio Forum Module

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulnCheck

Description
Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by directly accessing the module with read-only parameters.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-69091
EUVD
EUVD-2026-52284

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
admidio admidio to 5.0.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Admidio before version 5.0.11 has an authentication bypass flaw in its forum module when set to login-only mode. The issue is in modules/forum.php where the login-only setting is not properly checked, letting unauthenticated users read forum topics and posts by directly accessing the module with read parameters.

Detection Guidance

Check if Admidio is running version 5.0.11 or earlier. Inspect network traffic for unauthorized access to the forum module with read-only parameters. Review server logs for suspicious direct module access attempts.

Impact Analysis

Unauthenticated attackers could access private forum discussions, exposing sensitive information shared in posts or topics. This may lead to data leaks, reputational damage, or further exploitation if the exposed data contains credentials or personal details.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without consent and HIPAA by leaking protected health information if such data was discussed in forums. Organizations may face fines or penalties for failing to protect sensitive data.

Mitigation Strategies

Upgrade Admidio to version 5.0.11 or later immediately. Disable the forum module if not in use. Implement strict access controls to prevent unauthenticated module access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69091. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart