CVE-2026-69094 in admidio
Summary
by MITRE • 08/03/2026
Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the save_temporary mode of mylist_function.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' private lists by supplying a list_uuid parameter, transferring ownership and demoting global lists to personal configurations.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability represents a critical insecure direct object reference flaw in the Admidio content management system affecting versions prior to 5.0.11. The issue specifically resides within the save_temporary mode functionality of the mylist_function.php component where authenticated users can manipulate list configurations through improper input validation. The vulnerability stems from the application's failure to properly verify user authorization when processing list_uuid parameters, creating a scenario where legitimate users can access and modify objects they should not have permission to alter.
The technical implementation of this flaw allows attackers to enumerate global list UUIDs through systematic parameter manipulation and subsequently overwrite existing list configurations. When an authenticated user supplies a list_uuid parameter, the system processes the request without adequate access controls, enabling unauthorized modification of both administrative global lists and other users' private configurations. This vulnerability operates at the application logic level where proper object reference validation fails to distinguish between legitimate and malicious requests.
The operational impact of this vulnerability extends beyond simple data manipulation as it fundamentally undermines the integrity of the list management system. Attackers can effectively hijack administrative configurations, transfer ownership of global lists from administrators to themselves, and demote centrally managed lists to personal configurations. This creates a scenario where critical organizational list settings can be altered without proper authorization, potentially leading to data exposure, configuration corruption, or unauthorized access to sensitive information that was previously restricted to administrators.
Security implications of this vulnerability align with CWE-639 which specifically addresses insecure direct object reference flaws that allow unauthorized access to resources. The attack vector follows patterns consistent with ATT&CK technique T1078.004 for valid accounts and T1566.001 for credential access through application vulnerabilities. Organizations using affected versions face significant risk of privilege escalation and data integrity compromise, as the vulnerability enables authenticated users to perform actions that should be restricted to administrators only.
Mitigation strategies should focus on implementing proper input validation and access control mechanisms within the mylist_function.php component. The system must validate that users possess appropriate authorization levels before allowing modification of list configurations, regardless of the UUID provided. Additionally, implementing proper object reference controls that verify user permissions against target resources would prevent unauthorized access to global or private lists. Regular security updates and patch management are essential for addressing this vulnerability in affected installations.