CVE-2026-82657

Admidio before 5.0.12 does not enforce login-only module restrictions on its RSS feed endpoints, leaving the forum and announcements feeds accessible to anyone. An unauthenticated attacker can send GET requests to rss/forum.php or rss/announcements.php and retrieve the feed contents even when those modules are configured to be available only to logged-in members. The disclosed data includes topic and post titles, full post text, author names, and timestamps, which can expose private club or association communications. Any deployment of Admidio prior to 5.0.12 that restricts the forum or announcements modules to members is affected. No public proof-of-concept, KEV listing, or in-the-wild exploitation is known, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Upgrade to Admidio 5.0.12 or later. If upgrading is not immediately possible, disable the forum and announcements RSS feeds or restrict access to the rss/ directory at the web-server level (for example, require authentication or limit it to trusted addresses), and review whether the exposed post content and author names are sensitive.