CVE-2026-69094: Admidio Auth Bypass Vulnerability

CVE-2026-69094 Overview

CVE-2026-69094 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in Admidio before version 5.0.11. The flaw resides in the save_temporary mode of mylist_function.php and allows authenticated users to hijack list configurations belonging to other users or administrators. Attackers can enumerate global list UUIDs and supply a crafted list_uuid parameter to overwrite admin-curated global lists or other users' private lists. Successful exploitation transfers ownership of the affected lists to the attacker and demotes global lists to personal configurations, breaking data integrity across the application.

Critical Impact
Authenticated attackers can hijack and overwrite arbitrary list configurations, including admin-curated global lists, by manipulating the list_uuid parameter.

Affected Products

Admidio versions prior to 5.0.11
mylist_function.php component (save_temporary mode)
Deployments exposing authenticated list management functionality

Discovery Timeline

2026-08-03 - CVE-2026-69094 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-69094

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference in Admidio, an open-source membership management platform. The save_temporary mode of mylist_function.php accepts a list_uuid parameter from authenticated users without verifying ownership or authorization. Because the identifier directly references server-side list objects, any authenticated user can target lists they do not own.

An attacker enumerates UUIDs of global lists or other users' private lists and submits them through the save operation. The application accepts the request and rewrites the referenced list with attacker-controlled configuration. The action also transfers ownership to the attacker and downgrades global lists into personal ones, removing them from shared use.

The attack requires only low-privilege authenticated access and no user interaction. Impact is limited to integrity of list configurations; confidentiality and availability of the broader system remain unaffected.

Root Cause

The root cause is missing authorization on the object reference. The save_temporary handler trusts the client-supplied list_uuid and does not check whether the authenticated user owns the referenced list or holds administrative rights to modify global lists. This is a textbook [CWE-639] Authorization Bypass Through User-Controlled Key condition.

Attack Vector

Exploitation is performed over the network by an authenticated low-privilege user. The attacker enumerates or guesses valid list UUIDs, then issues a POST request to the save_temporary mode of mylist_function.php with the target list_uuid. The server processes the request as if the attacker owned the object, overwriting the list configuration and reassigning ownership. Consult the GitHub Security Advisory and the VulnCheck Advisory for the full technical write-up.

Detection Methods for CVE-2026-69094

Indicators of Compromise

Unexpected ownership changes on global lists, particularly global lists appearing as personal configurations under non-admin accounts.
HTTP POST requests to mylist_function.php with mode=save_temporary and a list_uuid value that does not belong to the requesting user.
Audit log entries showing rapid, sequential save operations against multiple distinct list_uuid values from a single account.

Detection Strategies

Correlate web server access logs with application ownership tables to flag requests where the acting user is not the pre-request owner of the referenced list_uuid.
Alert on enumeration behavior: a single authenticated session issuing many distinct list_uuid values within a short window.
Baseline expected admin activity against global lists and alert when non-admin accounts modify them.

Monitoring Recommendations

Enable Admidio audit logging and forward events to a central log platform for retention and correlation.
Monitor for anomalous write patterns against list configuration tables in the backing database.
Track HTTP 200 responses to save_temporary requests initiated by low-privilege accounts.

How to Mitigate CVE-2026-69094

Immediate Actions Required

Upgrade Admidio to version 5.0.11 or later, which contains the authorization fix for the save_temporary handler.
Review current list ownership and restore any global lists that have been demoted or reassigned.
Rotate credentials for accounts that show suspicious mylist_function.php activity.

Patch Information

The issue is fixed in Admidio 5.0.11. Refer to the GitHub Security Advisory GHSA-rw2j-8c57-x6h2 for the release notes and remediation details.

Workarounds

Restrict access to the Admidio instance to trusted authenticated users until the patch is applied.
Temporarily disable list management features for non-admin roles where feasible.
Place the application behind a web application firewall rule that blocks save_temporary requests referencing list UUIDs the session does not own.

bash

# Upgrade Admidio to the fixed release
cd /var/www/admidio
git fetch --tags
git checkout v5.0.11
# Run the built-in updater from the web UI: /adm_program/installation/update.php