Sign in
Deutsch English Español Polski
Medium

Admidio Insufficient Session Expiration vulnerability

  • Disclosed: 06.08.2023
  • Updated: 11.10.2026 10:22

Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11. This vulnerability allows a user's session to remain valid even after the user has logged out, potentially granting unauthorized access to sensitive areas and functionalities.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package admidio/admidio < 4.2.11 4.2.11

References

CVSS score 6.5/10
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness (CWE)
CWE-613
Platform
Composer
Package
admidio/admidio
Disclosed
06.08.2023
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-qq8m-9rpx-w2fm - CC BY 4.0

Vulnerability history: admidio/admidio

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (50) in the archive
Total entries
50
First → latest
03.2022 07.2026
Without a fix
1
Exploited in attacks
0

Severity breakdown

  • Critical 3
  • High 10
  • Medium 33
  • Low 4

Disclosures per year

Severity:
  1. Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders
    High · 8.1 CVE-2026-47231 < 5.0.10 5.0.10
  2. Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest
    High · 8.2 CVE-2026-41670 < 5.0.9 5.0.9
  3. Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests
    High · 8.2 CVE-2026-41669 < 5.0.9 5.0.9
  4. Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP
    High · 7.1 CVE-2026-41660 < 5.0.9 5.0.9
  5. Admidio allows Unauthenticated Access to Role-Restricted documents via neutralized .htaccess
    High · 7.5 CVE-2026-34381 >= 5.0.0, < 5.0.8 5.0.8
  6. Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)
    High · 8.0 CVE-2026-32813 < 5.0.7 5.0.7
  7. Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
    Critical · 9.1 CVE-2026-32817 >= 5.0.0, < 5.0.7 5.0.7
  8. File Upload(RCE) Vulnerability in admidio
    High · 8.8 CVE-2026-32756 < 5.0.7 5.0.7
  9. Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality
    High · 7.2 CVE-2025-62617 < 4.3.17 4.3.17
  10. Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment
    Critical · 9.0 CVE-2024-38529 < 4.3.10 4.3.10
  11. Admidio has Blind SQL Injection in ecard_send.php
    Critical · 9.9 CVE-2024-37906 < 4.3.9 4.3.9
  12. Admidio Insufficient Session Expiration vulnerability this entry
    Medium · 6.5 CVE-2023-4190 < 4.2.11 4.2.11
  13. Admidio Improper Neutralization of Formula Elements in a CSV File vulnerability
    High · 7.3 CVE-2023-3302 < 4.2.9 4.2.9
  14. Insufficient Session Expiration in Admidio
    High · 8.2 CVE-2022-0991 < 4.1.9 4.1.9

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.