PT-2026-116485 · Admidio · Admidio
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Admidio versions prior to 5.0.16
Description
An information disclosure issue exists where unauthenticated attackers can view role-restricted weblinks. This occurs because the 'rss/links.php' endpoint omits the
category view role-visibility filter, allowing attackers to request the weblinks RSS feed for an organization and retrieve link names, URLs, descriptions, categories, and creator names from restricted LNK categories.Recommendations
Update to version 5.0.16 or later.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Admidio