CVE-2026-69091CWE-306

CVE-2026-69091

High · published August 3, 2026

CVSS v3.1

7.5

EPSS

Percentile

48.7

In the wild

Unconfirmed

What it is

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by directly accessing the module with read-only parameters.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00613 · 48.7th percentile
Weakness: CWE-306 · Missing Authentication for Critical Function
Published: 2026-08-03T18:16Z

References (2)

https://github.com/Admidio/admidio/security/advisories/GHSA-cf48-6jrq-gjcm · [email protected]https://www.vulncheck.com/advisories/admidio-before-authentication-bypass-via-forum-php · [email protected]

EPSS history

Timeline

03 AUG 13:20Z
Admidio before 5.0.11 Authentication Bypass via forum.php
cvelistv5