CVE-2026-111913

Name of the Vulnerable Software and Affected Versions Admidio versions 5.0.0 through 5.0.15

Description An authorization bypass allows authenticated users to export lists even when export restrictions are active. This occurs because the groups roles export check in the modules/groups-roles/lists show.php file fails to account for the pdfl mode. Consequently, users with list view permissions can download member lists as PDF files by requesting the mode parameter with the value pdfl.

Recommendations Update Admidio to version 5.0.16.