Summary
CVE-2026-82657 is an authentication-bypass / information-disclosure vulnerability in Admidio, an open-source user management system for organizations and groups. The RSS feed endpoints for the forum and announcements modules fail to enforce the "login-only" access restriction that the corresponding interactive module pages already enforce, allowing unauthenticated users to read member-only forum posts and announcements. The issue is rated HIGH severity (CVSS v3.1 7.5, CVSS v4.0 8.7) and affects all Admidio installations prior to version 5.0.12.
Technical details
- Root cause:
rss/forum.phpandrss/announcements.phponly check whether a module is fully disabled (mode 0); they do not check for the "login-only" restriction (mode 2) that the module’s normal web pages enforce. - Trigger condition: The forum or announcements module is configured to require login ("registered users only"), while the site’s RSS/web feed feature remains enabled.
- Attack vector: Network-based; an unauthenticated attacker sends a plain GET request to the RSS feed URL for the forum or announcements module — no credentials, prior access, or user interaction required.
- Impact: Disclosure of thread titles, full post bodies, author names, timestamps, and category information from modules intended to be restricted to registered members. A related, earlier fix (GHSA-cf48-6jrq-gjcm) closed this gap for the interactive module pages but did not update the RSS endpoints.
Affected software
- Admidio versions up to and including 5.0.11
Severity
- CVSS v3.1 Base Score: 7.5 (HIGH) —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS v4.0 Base Score: 8.7 (HIGH)
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-306: Missing Authentication for Critical Function
Mitigation and recommended actions
- Immediate: Upgrade Admidio to version 5.0.12 or later, which enforces the login-only restriction on the RSS feed endpoints.
- If patching is not immediately possible: Disable the site-wide "Enable web feeds" (RSS) setting, or set the forum and announcements modules to fully disabled rather than login-only until the upgrade can be applied, to prevent the RSS endpoints from serving restricted content to unauthenticated requests.

