PT-2026-26173

Summary The forum module in Admidio does not verify whether the current user has permission to delete forum topics or posts. Both the topic delete and post delete actions in forum.php only validate the CSRF token but perform no authorization check before calling delete. Any authenticated user wit...