CVE-2026-32813: Admidio User Management SQLi Vulnerability

CVE-2026-32813 Overview

CVE-2026-32813 is a second-order SQL injection vulnerability affecting Admidio, an open-source user management solution. The vulnerability exists in versions 5.0.6 and below within the MyList configuration feature, which allows authenticated users to define custom list column layouts. While user-supplied values are safely stored using prepared statements, they are subsequently read back and interpolated directly into dynamically constructed SQL queries without proper sanitization or parameterization—creating a classic second-order SQL injection attack surface.

Critical Impact

An attacker with authenticated access can inject arbitrary SQL through the MyList configuration, potentially reading, modifying, or deleting any data in the database and achieving full database compromise.

Affected Products

• Admidio versions 5.0.6 and below
• Admidio MyList configuration feature
• Systems using the adm_list_columns table for custom list layouts

Discovery Timeline

• 2026-03-20 - CVE-2026-32813 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-32813

Vulnerability Analysis

This vulnerability represents a textbook example of second-order SQL injection (also known as stored SQL injection). The attack pattern involves two distinct phases: an initial "safe write" where malicious input is stored, followed by an "unsafe read" where the stored data is retrieved and used unsafely.

The MyList configuration feature in Admidio allows authenticated users to customize list views by defining column names, sort directions, and filter conditions. These user-supplied values are stored in the adm_list_columns table using prepared statements, which correctly prevents first-order SQL injection during the write operation.

However, when these stored values are later retrieved to construct dynamic SQL queries for rendering the customized lists, the application fails to apply parameterization or sanitization. The values are directly interpolated into the SQL query string, allowing any previously stored malicious SQL payloads to execute.

Root Cause

The root cause is improper handling of stored data when constructing dynamic SQL queries. The development team correctly implemented prepared statements for the initial data storage operation but failed to recognize that stored data can still contain malicious content that requires sanitization or parameterization when used in subsequent query construction.

This represents CWE-89 (SQL Injection) where the trust boundary is incorrectly assumed to exist between the storage and retrieval operations. Data that passes through the database is not inherently safe, especially when it originates from user input.

Attack Vector

The attack is network-accessible and requires low-privilege authenticated access to the Admidio application. An attacker would:

1. Authenticate to the Admidio application with any valid user account
2. Navigate to the MyList configuration interface
3. Create or modify a list column definition, injecting SQL payloads into column names, sort directions, or filter condition fields
4. Wait for (or trigger) the application to render a list view that utilizes the compromised configuration
5. The injected SQL executes with the database permissions of the application

The vulnerability requires some user interaction as the attacker needs to navigate to specific application functionality. The impact extends to full confidentiality, integrity, and availability compromise of the database.

Detection Methods for CVE-2026-32813

Indicators of Compromise

• Unusual or malformed entries in the adm_list_columns table containing SQL syntax
• Database error logs showing syntax errors from dynamic query construction
• Unexpected database queries or operations not matching normal application behavior
• Evidence of data exfiltration or unauthorized data modifications

Detection Strategies

• Monitor database logs for queries with unusual patterns, especially those referencing the list columns functionality
• Implement application-level logging to track modifications to the MyList configuration
• Deploy Web Application Firewall (WAF) rules to detect SQL injection patterns in form submissions
• Conduct regular audits of the adm_list_columns table for suspicious content

Monitoring Recommendations

• Enable detailed SQL query logging on database servers hosting Admidio
• Configure alerting for database errors originating from list rendering operations
• Implement integrity monitoring for the adm_list_columns table
• Review application access logs for patterns indicating configuration tampering

How to Mitigate CVE-2026-32813

Immediate Actions Required

• Upgrade Admidio to version 5.0.7 or later immediately
• Audit the adm_list_columns table for any suspicious or malformed entries
• Review database access logs for signs of exploitation
• Consider temporarily disabling the MyList configuration feature until patching is complete

Patch Information

Admidio has released version 5.0.7 which addresses this vulnerability. The fix is available in commit 3473bf5a7aa1bfc5043e73979719396276f4189f. Organizations should upgrade to the patched version immediately.

For detailed patch information, refer to the GitHub Commit Changes and the GitHub Security Advisory GHSA-3x67-4c2c-w45m.

Workarounds

• Restrict access to the MyList configuration feature to trusted administrators only
• Implement database-level auditing and monitoring for the adm_list_columns table
• Deploy a Web Application Firewall with SQL injection detection rules
• Consider implementing row-level security or database triggers to validate stored configuration values

The vulnerability mechanism involves stored values being directly interpolated into SQL queries during list rendering operations. Organizations unable to immediately patch should review the security advisory for specific implementation details and apply defense-in-depth measures until the upgrade can be completed.