CVE-2026-111913
Received Received - Intake

Authorization Bypass in Admidio via PDF Export

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl. The groups_roles_export check in modules/groups-roles/lists_show.php omits pdfl, which later runs the pdf export, letting users with list view rights download member lists as PDF files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111913
EUVD
EUVD-2026-103307

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Admidio admidio 5.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111913 is an authorization bypass vulnerability in Admidio versions 5.0.0 to 5.0.15. It allows authenticated users with list view rights to export member lists as PDF files even when export restrictions are in place. The flaw occurs because the permission check in lists_show.php omits the 'pdfl' mode, which later converts to 'pdf' and bypasses access controls.

Detection Guidance

Check Admidio version with: grep -r 'version' /path/to/admidio. If version is between 5.0.0 and 5.0.15, the system is vulnerable. Inspect modules/groups-roles/lists_show.php for missing 'pdfl' in permission checks at line 215.

Test by attempting to export a list with mode=pdfl. If successful without proper permissions, the vulnerability is present.

Impact Analysis

This vulnerability allows unauthorized users to download sensitive member lists as PDF files, bypassing intended export restrictions. While it does not expose additional confidential data beyond what users can already view, it undermines policy enforcement and could lead to unauthorized data collection.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized access to sensitive member data, potentially violating data protection requirements such as GDPR or HIPAA. It undermines access controls designed to protect personal information, increasing the risk of regulatory penalties.

Mitigation Strategies

Upgrade Admidio to version 5.0.16 or later immediately to patch the authorization bypass.

Temporarily restrict access to the lists_show.php file or disable PDF export functionality until patched.

Review audit logs for unauthorized PDF export attempts and revoke any suspicious user permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111913. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart