CVE-2026-82655 Admidio CVE debrief

Who should care

Organizations using Admidio, especially those with publicly accessible installations, should be aware of this vulnerability and take immediate action to patch or mitigate it. Security teams and database administrators should prioritize this vulnerability due to its high CVSS score of 8.7 and the potential for unauthorized database access.

Technical summary

The vulnerability exists in the lists_show.php file of Admidio, specifically in the relation_type_list parameter. This parameter is vulnerable to blind SQL injection, allowing attackers to execute arbitrary SQL queries without authentication. By providing a dummy UUID in the role_list and injecting SQL through relation_type_list, attackers can potentially extract sensitive database contents, including password hashes and user credentials.

Defensive priority

Organizations using Admidio versions prior to 5.0.12 should prioritize patching this vulnerability to prevent potential unauthorized database access.

Recommended defensive actions

• Apply the patch for Admidio version 5.0.12 or later
• Conduct a thorough inventory of Admidio installations to identify potential exposure
• Implement additional monitoring to detect potential exploitation attempts
• Review database contents for signs of unauthorized access or modifications
• Verify Admidio version and update to 5.0.12 or later if necessary
• Review system logs for suspicious activity related to Admidio
• Perform a security audit to identify other potential vulnerabilities

Evidence notes

The CVE description indicates a blind SQL injection vulnerability in Admidio's lists_show.php, specifically in the relation_type_list parameter. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially leading to the extraction of sensitive database contents, including password hashes and user credentials.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.