Cloudanix VulnDB

GHSA-g375-5wmp-xr78

Medium · 6.5

Admidio is Missing Authorization on Forum Topic and Post Deletion

CVSS

6.5

EPSS

—

Published

Mar 16, 2026

CISA due date

—

The record

The forum module in Admidio does not verify whether the current user has permission to delete forum topics or posts. Both the `topic_delete` and `post_delete` actions in `forum.php` only validate the CSRF token but perform no authorization check before calling `delete()`. Any authenticated user with forum access can delete any topic (with all its posts) or any individual post by providing its UUID. This is inconsistent with the save/edit operations, which properly check `isAdministratorForum()` and ownership before allowing modifications.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities