CVE-2026-111913CWE-285

CVE-2026-111913

Medium · published October 17, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
7.4
In the wild
Unconfirmed
What it is

Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl. The groups_roles_export check in modules/groups-roles/lists_show.php omits pdfl, which later runs the pdf export, letting users with list view rights download member lists as PDF files.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00182 · 7.4th percentile
Weakness
CWE-285 · Improper Authorization
Published
2026-10-17T23:16Z
References (3)
https://github.com/Admidio/admidio/security/advisories/GHSA-86f5-rg96-frrj · [email protected]https://www.vulncheck.com/advisories/admidio-5.0.0-before-5.0.16-authorization-bypass-via-pdfl-mode-in-lists-show-php · [email protected]https://github.com/Admidio/admidio/security/advisories/GHSA-86f5-rg96-frrj · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 19 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 17 OCT 18:46Z
    Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php
    cvelistv5
  • 17 OCT 18:46Z
    Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php
    cvelistv5