Description

Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reload_future_memberships endpoint with a victim's user UUID to disclose sensitive membership information.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-30T15:16:46.747Z",
  "pubdate": "2026-08-30T15:16:46.747Z",
  "executiveSummary": "Admidio versions prior to 5.0.12 are susceptible to a broken access control vulnerability located within the profile_function.php component. This flaw allows authenticated users with low privileges to bypass standard authorization checks to access sensitive information belonging to other users.\nThe vulnerability specifically facilitates the unauthorized disclosure of future role memberships. By targeting the reload_future_memberships endpoint and supplying a valid victim user UUID, an attacker can retrieve membership details that should be restricted based on profile-level permissions.\nThis issue represents a significant privacy concern, as it allows for the enumeration of organizational role structures and individual user associations without the victim's consent or authorization. The exploitation process is straightforward, requiring only an active low-privilege session and knowledge of the target user's UUID. There are no complex prerequisites, making this an accessible vector for authenticated malicious actors aiming to map internal memberships within the Admidio platform.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient implementation of server-side access control checks within the profile_function.php file. Specifically, the application fails to validate whether the authenticated user requesting data via the reload_future_memberships function possesses the appropriate authorization level to view the future role memberships associated with the provided target user UUID.\nIn a secure configuration, the application should verify the relationship between the requester and the requested resource or ensure the requester has sufficient administrative privileges to view external membership data. However, the current implementation implicitly trusts the input parameters provided in the request without cross-referencing them against the current session's authorization scope.\nThe attack flow follows a predictable pattern: 1) The attacker establishes an authenticated session as a standard, low-privilege user within the Admidio instance. 2) The attacker identifies the unique user UUID of a target victim, which is often discoverable via public-facing profile pages or directory listings. 3) The attacker crafts a targeted HTTP request to the reload_future_memberships function, passing the victim's UUID as an argument. 4) The server-side logic in profile_function.php processes the request, failing to perform a mandatory permission check. 5) The application returns a response containing the serialized future role memberships of the specified user, which is then parsed by the attacker to extract sensitive information.\nThis vulnerability is restricted to authenticated sessions, meaning it is not exploitable by unauthenticated external parties unless they have successfully compromised a low-privilege account. Once exploited, the impact includes the exposure of private role data, which may be leveraged for further social engineering, privilege escalation reconnaissance, or privacy violation within the Admidio ecosystem. The flaw specifically affects the handling of dynamic membership updates, bypassing the protections intended to guard personal information against unauthorized inspection.\nBecause the reload_future_memberships endpoint performs the data retrieval without enforcing a 'same-user' or 'authorized-administrator' check, it effectively acts as an information disclosure oracle regarding the future state of user roles within the system."
}