Incomplete fix for CVE-2026-32812: SSRF in admidio

Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation

Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint

Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php

Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update

Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.php

Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024

Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders

Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`

Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges

Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint

Admidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items

Admidio: Path Traversal in ECard Preview Allows Reading Arbitrary Server Files Including Database Credentials

Admidio is Missing Authorization on Forum Topic and Post Deletion

Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11

Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php

Admidio: Reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion

Admidio v4.2.12 and below is vulnerable to Cross Site Scripting (XSS)

Admidio is a free open source user management system for websites of organizations and groups

Admidio has Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions

Admidio is Missing CSRF Protection on Role Membership Date Changes

Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation

Admidio: HTMLPurifier Bypass in eCard Message Allows HTML Email Injection

Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter

Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9

Cross-site Scripting (XSS) - Stored in GitHub repository admidio/admidio prior to 4.2.8

Admidio 4.1.2 version is affected by stored cross-site scripting (XSS)

Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed

Admidio 3.3.5 Cross-Site Request Forgery via roles_function.php

Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests

Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords

Admidio: Missing Minimum Administrator Check in Role Membership Removal

Admidio before 5.0.11 Cross-Organization Role Modification

Admidio: Cross-Organization Member Data Exposure via Permission Check Mismatch in contacts_data.php

Admidio before 5.0.11 CSRF via category-report preferences

Admidio: Missing CSRF Protection on Custom List Deletion in mylist_function.php

Admidio: Path Traversal via Unvalidated `name` Parameter in Document Add Mode Enables Arbitrary Server File Read

admidio 3.2.8 has CSRF in adm_program/modules/members/members_function.php with an impact of deleting arbitrary user accounts

Admidio writes session IDs and auto-login cookie values to application logs

Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php

Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php

Admidio before 5.0.12 Broken Access Control via profile_function.php

Admidio PKCS#12 private key export action lacks CSRF protection

Admidio before 5.0.11 IDOR via save_temporary mylist_function.php

Admidio is an open-source user management solution