Description
Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl. The groups_roles_export check in modules/groups-roles/lists_show.php omits pdfl, which later runs the pdf export, letting users with list view rights download member lists as PDF files.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Admidio | admidio | 5.0.0 – < 5.0.16 | 5.0.16 |
References
- GitHub Security Advisory (GHSA-86f5-rg96-frrj) vendor-advisory
- VulnCheck Advisory: Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php third-party-advisory