CVE-2026-41657

MEDIUM 4.9

Admidio: Cross-Organization Member Data Exposure via Permission Check Mismatch in contacts_data.php

CVSS Score

4.9

EPSS Score

0.0%

EPSS Percentile

0th

Admidio is an open-source user management solution. Prior to version 5.0.9, the contacts_data.php endpoint uses a weaker permission check (isAdministratorUsers(), requiring only rol_edit_user=true) than the frontend UI (contacts.php) which correctly requires the stronger isAdministrator() (requiring rol_administrator=true) and the contacts_show_all system setting. A user manager who is not a full administrator can directly request contacts_data.php?mem_show_filter=3 to retrieve all user records across all organizations in the Admidio instance, bypassing multi-tenant organization isolation. This issue has been patched in version 5.0.9.

CWE	CWE-863
Vendor	admidio
Product	admidio
Published	May 7, 2026

Stay Ahead of the Next One

Get instant alerts for admidio admidio

Be the first to know when new medium vulnerabilities affecting admidio admidio are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

Admidio / admidio

< 5.0.9

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Admidio/admidio/security/advisories/GHSA-g8p8-94f2-28gr github.com: https://github.com/Admidio/admidio/releases/tag/v5.0.9