Admidio Information Disclosure via RSS Feed Endpoints

Executive Summary

CVE-2026-82657 is an authentication bypass vulnerability in Admidio versions before 5.0.12. It allows unauthenticated attackers to access sensitive content via RSS feed endpoints for forum and announcements modules. These endpoints do not enforce login-only restrictions, exposing titles, full post text, author names, and timestamps even when modules are configured as login-only.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if unauthenticated GET requests to /rss/forum.php or /rss/announcements.php return sensitive content. Use curl commands like: curl -I http://<target>/rss/forum.php and curl http://<target>/rss/announcements.php. If these return forum topics or announcements without authentication, the system is vulnerable.

Compare with other RSS feeds (events, links, photos) which should enforce login restrictions. If forum and announcements feeds return data while others do not, the issue exists.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of confidential information. Attackers can retrieve internal discussions, personal details, and sensitive posts without authentication. The impact includes loss of data confidentiality, potential reputational damage, and exposure of member-only information such as forum topics and announcements.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection regulations like GDPR and HIPAA. It enables unauthorized access to personal and sensitive data, which could result in regulatory penalties, legal liabilities, and loss of trust. Organizations using affected Admidio versions must address this to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Admidio to version 5.0.12 or later to patch the vulnerability. If upgrading is not immediately possible, restrict access to the vulnerable RSS endpoints via web server rules or firewall blocking.

Temporarily disable the forum and announcements modules if they are not critical, or configure them to be publicly accessible only if absolutely necessary.

Useful 0 Not Useful 0