A critical authentication bypass in Admidio versions prior to 5.0.12 allows unauthenticated attackers to exfiltrate sensitive forum and announcement data via RSS feed endpoints.

This vulnerability involves an improper access control flaw (CWE-200) where the application fails to perform a capability check on the RSS feed endpoints. Unauthenticated attackers can exploit this by sending direct GET requests to specific PHP files, resulting in the unauthorized disclosure of private system information.

The exposure of sensitive internal communications, such as forum topics and announcements, poses a significant risk to organizational confidentiality and privacy. Given the CVSS score of 7.5, this high-severity vulnerability allows for the mass scraping of private user data without requiring any prior authentication, potentially leading to unauthorized information leakage and reputational damage.

Immediate Action: Upgrade to Admidio version 5.0.12 or later to apply the necessary access control restrictions to the affected RSS feed modules.

Proactive Monitoring: Review web server access logs for anomalous GET requests directed at the rss/forum.php and rss/announcements.php endpoints from unauthorized IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or restrict access to the identified RSS feed files until the software update can be deployed.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a significant risk to data privacy and should be addressed as a priority. Administrators must verify their current version and apply the 5.0.12 update immediately to close the unauthorized access path, as the ease of exploitation makes this an attractive target for automated scraping and reconnaissance.