IDOR in Messages function in admidio/admidio


Reported on

Jun 9th 2022


An user can view other users' private messages, join the conversation, delete messages if they know messages uuid

Proof of Concept

1. A send B a priavte messages/email
2. C can view messages, join the conversation, delete messages if C know messages uuid


This vulnerability is capable of leak private information, delete chats

We are processing your report and will contact the admidio team within 24 hours. 10 months ago
We have contacted a member of the admidio team and are waiting to hear back 9 months ago
We have sent a follow up to the admidio team. We will try again in 7 days. 9 months ago
Markus Faßbender validated this vulnerability 9 months ago
Andy has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Markus Faßbender gave praise 9 months ago
Thanks for researching this issue. I'm working on a fix and will release a new version soon.
The researcher's credibility has slightly increased as a result of the maintainer's thanks: +1
Markus Faßbender marked this as fixed in 4.1.13 with commit 64c304 9 months ago
Markus Faßbender has been awarded the fix bounty
This vulnerability will not receive a CVE
to join this conversation