medium4.3
CVE-2026-82658
Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php that allows authenticated low-privilege users to read anot…
Impact
Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reload_future_memberships endpoint with a victim's user UUID to disclose sensitive membership information.
Affected products
| Product | Affected versions |
|---|---|
| Admidio | before 5.0.12 |
Versions were read from the advisory text. No structured product data has been published for this record yet.