Access Control Issue in Admidio Platform from Jochen F. and Team

CVE-2026-109329

What is CVE-2026-109329?

Admidio versions 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 have a broken access control vulnerability that enables role administrators to manipulate user roles across different organizations. This flaw allows unauthorized users to submit malicious role assignment requests targeting the members_assignment.php script with foreign role UUIDs. As a result, attackers can potentially acquire privileged memberships, gain access to those organizations, and alter user profiles, posing a significant risk to system security and data integrity.

References