CVE-2026-109329

Name of the Vulnerable Software and Affected Versions Admidio versions 4.3.2 through 4.3.17 Admidio versions 5.0.0 through 5.0.14

Description Broken access control allows role administrators to assign users to roles within other organizations. This is achieved by submitting crafted requests to the 'members assignment.php' endpoint using a foreign role UUID. Successful exploitation enables an attacker to gain privileged membership, access the target organization, and modify user profiles.

Recommendations Update Admidio versions 4.3.2 through 4.3.17 to a version where this issue is resolved. Update Admidio versions 5.0.0 through 5.0.14 to version 5.0.15 or later.