Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export… (CVE-2026-111913)

The vulnerability in Admidio versions 5.0.0 before 5.0.16 is an authorization bypass that permits authenticated users to export member lists as PDF files even when export restrictions should prevent this. The root cause is that the groups_roles_export check in modules/groups-roles/lists_show.php does not include the 'pdfl' mode, which is later used to run the PDF export functionality. As a result, users who have rights to view lists can bypass export restrictions by requesting mode=pdfl, enabling unauthorized data export.

The impact is limited to unauthorized disclosure of member list information in PDF format by authenticated users who should not have export permissions. The CVSS score of 4.3 (medium severity) reflects limited confidentiality impact with no integrity or availability effects. There is no indication of active exploitation in the wild.

A fix is available in Admidio version 5.0.16. Users should upgrade to version 5.0.16 or later to resolve this authorization bypass vulnerability. Since this is not a cloud service, manual patching is required. Patch status is confirmed by the version range in the description. No additional mitigation steps are indicated.