CVE-2026-111916
Received Received - Intake

Admidio Information Disclosure via RSS Feed

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because rss/links.php omits the category_view role-visibility filter. Attackers can request the weblinks RSS feed for an organization to retrieve link names, URLs, descriptions, categories, and creator names from restricted LNK categories.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111916
EUVD
EUVD-2026-103305

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Admidio admidio 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111916 is an information disclosure vulnerability in Admidio versions before 5.0.16. It allows unauthenticated attackers to view role-restricted weblinks by exploiting a missing role-visibility filter in the RSS feed (rss/links.php). The HTML view applies proper filters but the RSS feed bypasses them, exposing sensitive link details from restricted categories.

Detection Guidance

Check if the weblinks RSS feed is accessible without authentication by accessing /rss/links.php for an organization. If it returns role-restricted links, the vulnerability is present. Use curl to test: curl -v http://<target>/admidio/rss/links.php?org=<org_id>

Verify Admidio version by checking the footer or changelog. Versions 5.0.15 and earlier are vulnerable. Use: grep -r 'Admidio' /var/www/html/admidio/ | grep version

Impact Analysis

Attackers can access restricted weblinks without authentication, potentially exposing sensitive information like link names, URLs, descriptions, categories, and creator names. This could lead to data leaks, unauthorized access to internal resources, or further exploitation if the exposed links contain sensitive endpoints.

Compliance Impact

This vulnerability could violate compliance requirements for data protection regulations like GDPR or HIPAA by exposing sensitive information to unauthorized parties. Organizations using affected Admidio versions may face legal penalties, reputational damage, or audit failures due to inadequate access controls.

Mitigation Strategies

Upgrade Admidio to version 5.0.16 or later immediately to patch the vulnerability. Download the latest version from the official Admidio website or repository.

Temporarily disable the RSS weblinks feed by setting enable_rss=0 in the Admidio configuration file until the upgrade is completed.

Review and restrict access to the /rss/links.php endpoint via web server configuration (e.g., Apache .htaccess or Nginx rules) to block unauthenticated requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111916. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart