CVE-2026-111912
Received Received - Intake

Authenticated Forum Topic Modification in Admidio

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users' forum topics. Attackers can replace the topic_uuid parameter in their own topic_save request, reusing their CSRF token, to overwrite the victim topic's title and first post.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111912
EUVD
EUVD-2026-103308

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Admidio admidio 5.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in Admidio versions 5.0.0 through 5.0.15. It allows authenticated users to modify forum topics belonging to other users by manipulating the topic_uuid parameter in their requests while reusing their own CSRF token. Exploiting this issue enables attackers to change the title and first post of a victim's forum topic.

Detection Guidance

To detect this vulnerability, monitor Admidio forum activity for unauthorized topic modifications. Check server logs for POST requests to /forum/save_topic with manipulated topic_uuid parameters. Look for CSRF token reuse across different user sessions. Verify if users can edit topics they do not own by attempting to modify topic_uuid in requests.

Impact Analysis

An attacker could modify your forum topics, changing titles or content without your permission. This could lead to misinformation, reputational damage, or loss of control over your discussions. The vulnerability requires the attacker to have basic user privileges.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized modification of user-generated content, potentially violating integrity and confidentiality requirements. GDPR emphasizes data integrity and user rights, while HIPAA mandates protection of sensitive health information. Unauthorized changes to forum posts may lead to data breaches or misinformation, undermining compliance efforts.

Mitigation Strategies

Immediately update Admidio to version 5.0.16 or later. Implement server-side checks to verify topic ownership before allowing modifications. Disable direct topic_uuid parameter manipulation in forum update requests. Review and restrict forum category edit permissions to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111912. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart