CVE-2026-111916 in Admidio
Summary
by MITRE • 10/17/2026
Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because rss/links.php omits the category_view role-visibility filter. Attackers can request the weblinks RSS feed for an organization to retrieve link names, URLs, descriptions, categories, and creator names from restricted LNK categories.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified in Admidio versions prior to 5.0.16 represents a critical failure in access control mechanisms within the application's web-based content management system. Specifically, this flaw resides in the rss/links.php script, which is responsible for generating RSS feeds for organizational weblinks. In secure software architecture, any endpoint that exposes sensitive data must enforce strict authentication and authorization checks to ensure that only users with appropriate privileges can access restricted resources. However, in this instance, the implementation of role-based visibility filters was incomplete or entirely absent for this specific functionality. The system correctly applies category_view permissions when rendering standard web pages but fails to replicate these security controls within the RSS feed generation logic. This discrepancy creates a significant gap where unauthenticated attackers can bypass intended access restrictions by directly targeting the API endpoint that serves the RSS data, effectively treating it as public information regardless of the underlying role assignments configured for specific link categories.
From a technical perspective, this vulnerability is classified under CWE-200: Information Exposure, which encompasses situations where sensitive information is made available to unauthorized actors without proper access controls. The root cause lies in the server-side logic that processes requests for RSS feeds; it retrieves data from the database based on organizational context but neglects to verify whether the requesting entity possesses the necessary category_view role permissions before serializing and returning the content. Consequently, an attacker does not need valid credentials or a logged-in session to exploit this flaw. By simply issuing HTTP GET requests to the rss/links.php endpoint associated with a target organization, the server responds with a structured XML feed containing detailed metadata about restricted links. This includes link names, full URLs, descriptive text, category classifications, and the usernames of creators who added these items. The absence of input validation regarding user session state or role tokens allows this data leakage to occur seamlessly through standard web requests.
The operational impact of this vulnerability is substantial for organizations relying on Admidio for internal communication and resource sharing. Since RSS feeds are often consumed by automated tools, aggregators, or even malicious scripts, the exposure of restricted weblinks can lead to a wide-ranging information disclosure incident. Attackers can harvest these links to map out internal infrastructure, identify potential entry points into private networks, or gather intelligence on organizational structure and personnel roles based on creator names. This level of detail aids in subsequent phases of an attack lifecycle, such as reconnaissance and target profiling, potentially facilitating more sophisticated attacks like phishing campaigns tailored to specific individuals identified through the leaked data. Furthermore, if any of the restricted links point to sensitive internal applications or documents, their exposure could lead to further unauthorized access depending on whether those downstream resources have independent security controls.
To mitigate this vulnerability, organizations running Admidio versions earlier than 5.0.16 must immediately upgrade to version 5.0.16 or later, where the developers have patched the rss/links.php script to enforce proper role-based visibility checks consistent with other parts of the application. Until an upgrade is feasible, administrators should consider implementing network-level controls such as firewall rules or web application firewalls that restrict access to RSS endpoints based on IP address ranges if possible, although this is a less robust solution than fixing the code itself. Additionally, reviewing and tightening general role permissions within Admidio can help minimize the blast radius in case of future vulnerabilities. It is also advisable to monitor logs for unusual patterns of requests targeting RSS feeds from unauthenticated sources as an indicator of potential exploitation attempts. This incident underscores the importance of consistent security implementation across all application modules, ensuring that API endpoints and dynamic content generators adhere to the same rigorous access control standards as user-facing interfaces.