Improper Permission Check in Admidio User Management Solution

CVE-2026-41657

What is CVE-2026-41657?

Admidio, an open-source user management solution, suffers from an improper permission check vulnerability in the contacts_data.php endpoint. Prior to version 5.0.9, the endpoint allowed users with insufficient permissions to bypass security measures, enabling them to access all user records across multiple organizations. This is due to the reliance on a weaker permission check (isAdministratorUsers()) instead of the stronger isAdministrator() requirement that properly enforces organization isolation. The vulnerability can be exploited by user managers lacking full administrative rights to obtain sensitive user data, leading to significant security risks. This issue has been addressed in version 5.0.9.

References