CVE-2026-82655

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.12

Description An issue exists that allows unauthenticated attackers to execute arbitrary SQL queries. By providing a dummy UUID in the role list parameter, attackers can bypass authentication and use the relation type list parameter in the 'lists show.php' endpoint to extract sensitive database contents, such as user credentials and password hashes. This is achieved through blind SQL injection, a technique used to retrieve data from a database by asking a series of true or false questions based on the application's response.

Recommendations Update to version 5.0.12 or later. Avoid using the relation type list parameter in the 'lists show.php' endpoint until the update is applied.