Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation_type_list parameter of lists_show.php that allows unauthenticated… (CVE-2026-82655)

The vulnerability (CVE-2026-82655) in Admidio before version 5.0.12 is a blind SQL injection in the relation_type_list parameter of the lists_show.php script. Attackers can bypass authentication by supplying a dummy UUID in the role_list parameter and then inject SQL commands via relation_type_list. This enables unauthorized extraction of database information including password hashes and user credentials. The CVSS 3.1 score is 7.5, indicating high severity with network attack vector, no privileges required, and no user interaction needed.

Successful exploitation allows unauthenticated attackers to execute arbitrary SQL queries on the backend database, potentially exposing sensitive information such as password hashes and user credentials. This compromises confidentiality but does not affect integrity or availability according to the CVSS vector.

A fix is available in Admidio version 5.0.12. Users should upgrade to version 5.0.12 or later to remediate this vulnerability. Since no patch links are provided, verify the vendor advisory or official release notes for the update. No other mitigation or temporary workaround is indicated.