CVE-2026-69094

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.11

Description An insecure direct object reference (IDOR) occurs in the save temporary mode of the mylist function.php file. This issue allows authenticated users to hijack list configurations by enumerating global list UUIDs. By supplying a specific list uuid parameter, an attacker can overwrite private lists of other users or global lists curated by administrators, effectively transferring ownership and demoting global lists to personal configurations.

Recommendations Update to version 5.0.11 or later.