CVE-2026-82658: Admidio before 5.0.12 Broken Access Control via profile_function.php
Admidio versions before 5.0.12 contain a broken access control vulnerability in profilefunction.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reloadfuturememberships endpoint with a victim's user UUID to disclose sensitive membership information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Admidioto a version that resolves this vulnerability.Fixed in 5.0.12 - Compensating control
Restrict access to the Admidio endpoint named "reload_future_memberships" so authenticated low-privilege users cannot call it with a victim user's UUID (enforce authorization in front of/around the endpoint).
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privilege Admidio user can exploit it. The attacker needs a target user's UUID and can directly invoke the reload_future_memberships endpoint.
What information can be exposed?
The issue exposes another user's future role memberships. The available data indicates confidentiality impact only; it does not indicate modification or service-disruption impact.
Which installations are affected?
Admidio versions before 5.0.12 are affected. The provided information does not state whether any particular deployment configuration prevents exposure.
How can I determine whether exploitation may have occurred?
Review application or web-server logs for requests to the reload_future_memberships endpoint, especially requests by low-privilege accounts that specify UUIDs belonging to other users. The provided data does not identify specific log fields or request patterns beyond the endpoint and victim UUID.