Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks… (CVE-2026-111916)

Admidio before version 5.0.16 contains an information disclosure vulnerability identified as CVE-2026-111916. The vulnerability arises from the omission of the category_view role-visibility filter in the rss/links.php endpoint. As a result, unauthenticated attackers can retrieve sensitive information from role-restricted link categories by requesting the weblinks RSS feed. The exposed data includes link names, URLs, descriptions, categories, and the names of the creators associated with those links. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

Unauthenticated attackers can access information that should be restricted to certain roles, specifically details about weblinks such as their names, URLs, descriptions, categories, and creator names. This could lead to unauthorized disclosure of organizational information but does not impact integrity or availability.

A fixed version 5.0.16 of Admidio addresses this vulnerability by applying the missing category_view role-visibility filter. Users should upgrade to version 5.0.16 or later to remediate this issue. Since no patch links or vendor advisory are provided, confirm the fix status with the official Admidio release notes or vendor advisory before upgrading. No other mitigations are specified.