Loading story…
Several newly disclosed Admidio vulnerabilities allow unauthorized or improperly authorized state-changing actions in core modules handling roles, documents, and forums. One flaw in modules/groups-roles/groups_roles.php is a CSRF issue that can let an attacker trick an authenticated user with rol_assign_roles privileges into activating, deactivating, or deleting organizational roles because the server does not properly enforce anti-CSRF validation for some sensitive requests. Additional Admidio issues stem from missing authorization checks on destructive actions, allowing operations to proceed after insufficient validation.
In the documents module, modules/documents-files.php uses read-access checks such as getFolderForDownload() and getFileForDownload() before executing folder_delete and file_delete, which can let any user who can view a file or folder delete it; in public-mode configurations, that can extend to unauthenticated deletion of public content. In the forum module, modules/forum.php validates a CSRF token for topic_delete and post_delete actions but fails to verify whether the requester is actually authorized to delete the targeted content, enabling arbitrary forum post or topic deletion. A separate disclosure affecting Campus Educativa describes an IDOR at /administracion/admin_usuarios.cgi that exposes enrolled-user data through brute-forced course IDs, but that is a different product and incident and should be treated separately.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Details were published for CVE-2026-32756, describing a critical unrestricted file upload vulnerability in Admidio's Documents & Files module. The disclosure stated that exploitation could enable arbitrary file upload, server compromise, data exfiltration, and lateral movement.
A critical unrestricted file upload vulnerability affecting Admidio 5.0.6 and earlier was addressed in Admidio version 5.0.7. The flaw allowed an authenticated user with upload permissions to bypass file extension restrictions via invalid CSRF token handling, potentially leading to remote code execution.
Three Admidio vulnerabilities were publicly disclosed: a CSRF issue in role management that can change or delete roles, a missing-authorization and CSRF flaw that allows unauthorized document or folder deletion, and an authorization bypass that permits arbitrary forum topic and post deletion.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvereports.com
Open sourcecvereports.com
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **CVE-2026-16337** affects **dotCMS** versions `21.02` through `26.06.22-03`, allowing a low-privileged authenticated backend user to escalate privileges and achieve remote code execution. The issue stems from improper authorization in the `ToolGroupResource` layout-assignment endpoints and `RoleAjax` REST/DWR methods, which let a user self-assign the administrative Settings layout, grant themselves the **CMS Administrator** role, and then upload a crafted OSGi bundle whose `BundleActivator` can run arbitrary shell commands on the host. dotCMS addressed the chain in core pull request **#36344** by enforcing **CMS Administrator** checks on `ToolGroupResource._addtouser`, `ToolGroupResource._removefromuser`, `RoleAjax.addUserToRole`, and `RoleAjax.removeUsersFromRole`, while preserving limited self-service behavior for the `gettingstarted` onboarding layout. A follow-up hardening change moved authorization checks ahead of `loadUserById` calls to block unauthorized requests before database access, and unit tests were added for the new admin gates and onboarding exceptions.
Jul 21, 2026
A newly recorded vulnerability, **CVE-2026-32968**, affects the `com_mb24sysapi` module and allows **unauthenticated remote code execution** through an OS command injection flaw. The weakness is classified as **CWE-78** and stems from improper neutralization of special elements in OS commands, enabling a remote attacker to execute arbitrary commands and potentially take full control of an affected system. The CVE is described as a variant of `CVE-2020-10383`, carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, and is referenced by CERT VDE advisories **VDE-2026-024** and **VDE-2026-025**. A separate high-severity issue, **CVE-2026-29839**, was recorded for **DedeCMS v5.7.118** in the `/sys_task_add.php` component. The flaw is a **Cross-Site Request Forgery** vulnerability classified as **CWE-352**, and its updated **CVSS v3.1** vector is `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`, indicating that successful exploitation could significantly affect confidentiality, integrity, and availability. The record includes references to a public gist and the DedeCMS website, highlighting another internet-exposed web application weakness with potentially serious impact.
Jun 29, 2026
A critical improper authorization vulnerability tracked as **`CVE-2026-12686`** has been disclosed in **Adiss’s Biloop** platform. According to the advisory published by **INCIBE-CERT**, the flaw allows an authenticated user to alter a company ID parameter in a backend `POST` request because the application fails to verify that the requested company belongs to the user’s active session within the same subdomain environment. Successful exploitation can enable **cross-tenant access** to other customers’ data, exposing sensitive information such as **billing records** and potentially allowing unauthorized modification of third-party data. The issue is described as **remotely exploitable** and carries a **CVSS 4.0 score of 9.3**, placing it in the **critical** severity range.
Jul 6, 2026