CVE-2026-34381High· 7.5▾ TwilightAdmidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, Admidio relies on adm_my_files/.htaccess to deny direct HTTP access to uploaded documents. The Docker image ships with AllowOverride None in …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
0.5% → 0.6%
Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, Admidio relies on adm_my_files/.htaccess to deny direct HTTP access to uploaded documents. The Docker image ships with AllowOverride None in the Apache configuration, which causes Apache to silently ignore all .htaccess files. As a result, any file uploaded to the documents module regardless of the role-based permissions configured in the UI, is directly accessible over HTTP without authentication by anyone who knows the file path. The file path is disclosed in the upload response JSON. This issue has been patched in version 5.0.8.
admidio >= 5.0.0, < 5.0.8Upgrade past the affected range:
admidio 5.0.8Connected by shared product, vendor, weakness, or advisory.
CVE-2026-117554Medium· 4.3Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php
CVE-2026-111914Medium· 6.5Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php
CVE-2026-111912Medium· 6.5Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update
CVE-2026-111913Medium· 4.3Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php
CVE-2026-111916Medium· 5.3Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed
CVE-2026-109329Medium· 6.5Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations