Detections
Analytics

SCA: security update for admidio/admidio (GHSA-g375-5wmp-xr78)

medium Tenable Cloud Security Plugin ID 438862

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the forum module in
 Admidio does not verify whether the current user has permission to delete forum topics or posts. Both the
 topic_delete and post_delete actions in forum.php only validate the CSRF token but perform no
 authorization check before calling delete(). Any authenticated user with forum access can delete any topic
 (with all its posts) or any individual post by providing its UUID. This is inconsistent with the save/edit
 operations, which properly check isAdministratorForum() and ownership before allowing modifications. Any
 logged-in user can permanently and irreversibly delete any forum topic (including all its posts) or any
 individual post by simply knowing its UUID (which is publicly visible in URLs), completely bypassing
 authorization checks. This issue has been fixed in version 5.0.7. (CVE-2026-32818)

Solution

Update the admidio/admidio library and its related packages to version 5.0.7 or later.

See Also

https://github.com/advisories/GHSA-g375-5wmp-xr78

Plugin Details

Severity: Medium

ID: 438862

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 3/17/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.51

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:N

CVSS Score Source: CVE-2026-32818

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/16/2026

Vulnerability Publication Date: 3/16/2026

Reference Information

CVE: CVE-2026-32818

cwe: CWE-862