CVE-2026-32813

Admidio is an open-source user management solution. Versions 5.0.6 and below are vulnerable to arbitrary SQL Injection through the MyList configuration feature. The MyList configuration feature lets authenticated users define custom list column layouts, storing user-supplied column names, sort directions, and filter conditions in the adm_list_columns table via prepared statements. However, these stored values are later read back and interpolated directly into dynamically constructed SQL queries without sanitization or parameterization, creating a classic second-order SQL injection vulnerability (safe write, unsafe read). An attacker can exploit this to inject arbitrary SQL, potentially reading, modifying, or deleting any data in the database and achieving full database compromise. This issue has been fixed in version 5.0.7.

• CWE-89

• https://github.com/Admidio/admidio/commit/3473bf5a7aa1bfc5043e73979719396276f4189fPatch
• https://github.com/Admidio/admidio/security/advisories/GHSA-3x67-4c2c-w45mExploit, Mitigation, Vendor Advisory
• https://github.com/Admidio/admidio/security/advisories/GHSA-3x67-4c2c-w45mExploit, Mitigation, Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32807dataCycle is a data management system for centrally storing,…7.5
• CVE-2026-32808pyLoad is a free and open-source download manager written in…8.1
• CVE-2026-3281A vulnerability was detected in libvips 8.19.0. This affects…7.8
• CVE-2026-32810Halloy is an IRC application written in Rust. In versions on…5.5
• CVE-2026-32811Heimdall is a cloud native Identity Aware Proxy and Access C…7.5
• CVE-2026-32812Admidio is an open-source user management solution. In versi…6.8
• CVE-2026-32814libheif is a HEIF and AVIF file format decoder and encoder. …6.5
• CVE-2026-32815SiYuan is a personal knowledge management system. In version…7.5
• CVE-2026-32816Admidio is an open-source user management solution. In versi…5.7
• CVE-2026-32817Admidio is an open-source user management solution. In versi…9.1
• CVE-2026-32818Admidio is an open-source user management solution. In versi…6.5
• CVE-2026-32819dataCycle is a data management system for centrally storing,…4.3