Role Modification Vulnerability in Admidio by Admidio Team

CVE-2026-69090

What is CVE-2026-69090?

A significant security flaw exists in Admidio versions prior to 5.0.11 that fails to properly validate organization membership within role handlers. This allows authenticated role administrators to manipulate roles belonging to other organizations. For instance, by providing a role UUID from a different organization to the groups_roles.php handlers, an attacker could delete, activate, deactivate, or edit roles without proper authorization, posing a serious risk to organizational integrity and data security.

References