CVE-2026-111916— Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed
Quick assessment
Affected
Admidio admidio
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Admidio 在 5.0.16 之前版本中存在一个信息泄露漏洞，该漏洞允许未认证的攻击者查看受角色限制的网络链接。由于 文件遗漏了 角色可见性过滤机制，攻击者可以请求组织的网络链接 RSS 源，从而获取受限制 LNK 类别中的链接名称、URL、描述、分类以及创建者姓名。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111916
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed
Source: CVE Program / CVE List V5
Vulnerability Description
Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because rss/links.php omits the category_view role-visibility filter. Attackers can request the weblinks RSS feed for an organization to retrieve link names, URLs, descriptions, categories, and creator names from restricted LNK categories.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-111916
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111916
请登录查看更多情报信息。
Other References for CVE-2026-111916 (2)
Same Patch Batch · Admidio · 2026-10-17 · 4 CVEs total
| CVE-2026-111912 | 6.5 MEDIUM | Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update |
| CVE-2026-111914 | 6.5 MEDIUM | Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php |
| CVE-2026-111913 | 4.3 MEDIUM | Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php |
IV. Related Vulnerabilities
Same product: admidio
-
CVE-2026-111914
Admidio 5.0.11 before 5.0.16 Broken Access Control via inven -
CVE-2026-111912
Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update -
CVE-2026-111913
Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mo -
CVE-2026-109329
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-O -
CVE-2026-109328
Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via R
Same vendor: Admidio
-
CVE-2026-111914
Admidio 5.0.11 before 5.0.16 Broken Access Control via inven -
CVE-2026-111913
Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mo -
CVE-2026-111912
Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update -
CVE-2026-109329
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-O -
CVE-2026-109328
Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via R
Same weakness: CWE-862
-
CVE-2026-110882
WordPress SMS Alert Order Notifications plugin <= 4.0.1 - Br -
CVE-2026-111914
Admidio 5.0.11 before 5.0.16 Broken Access Control via inven -
CVE-2026-111910
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Auth -
CVE-2026-111897
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass -
CVE-2026-111889
phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-bet
V. Comments for CVE-2026-111916
No comments yet