CVE-2026-32813: Admidio SQL injection (CVSS 8.0)

Description

Admidio is an open-source user management solution. Versions 5.0.6 and below are vulnerable to arbitrary SQL Injection through the MyList configuration feature. The MyList configuration feature lets authenticated users define custom list column layouts, storing user-supplied column names, sort directions, and filter conditions in the adm_list_columns table via prepared statements. However, these stored values are later read back and interpolated directly into dynamically constructed SQL queries without sanitization or parameterization, creating a classic second-order SQL injection vulnerability (safe write, unsafe read). An attacker can exploit this to inject arbitrary SQL, potentially reading, modifying, or deleting any data in the database and achieving full database compromise. This issue has been fixed in version 5.0.7.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionRequired

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

Admidio< 5.0.7

Remediation

Fixed in

Admidio≥ 5.0.7

Patch & vendor advisories

References

https://github.com/Admidio/admidio/commit/3473bf5a7aa1bfc5043e73979719396276f4189fPatch
https://github.com/Admidio/admidio/security/advisories/GHSA-3x67-4c2c-w45mExploitMitigationVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-32813 being actively exploited?

CVE-2026-32813 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.42%.

How severe is CVE-2026-32813?

CVE-2026-32813 has a CVSS 3.1 base score of 8.0, rated high. EPSS estimates a 0.42% probability of exploitation.

Which products are affected by CVE-2026-32813?

Affected products include Admidio.

How do I fix CVE-2026-32813?

Upgrade affected software to a fixed version, for example Admidio 5.0.7 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-32813 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo