Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules. (CVE-2026-82657)

The vulnerability identified as CVE-2026-82657 affects Admidio versions prior to 5.0.12. It involves a failure to enforce login-only module restrictions on the RSS feed endpoints rss/forum.php and rss/announcements.php. As a result, unauthenticated attackers can send GET requests to these endpoints and retrieve sensitive content from the forum and announcements modules without authentication. The disclosed information includes titles, full post text, author names, and timestamps, constituting an information disclosure vulnerability classified under CWE-200.

This vulnerability leads to unauthorized disclosure of sensitive information from the forum and announcements modules of Admidio. Attackers can access private content without authentication, potentially exposing confidential discussions and announcements. The CVSS 3.1 base score is 7.5 (high severity), reflecting the network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact with no impact on integrity or availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected RSS feed endpoints by implementing access controls or authentication mechanisms at the web server or application level to prevent unauthenticated access.