CVE-2026-82658

Medium

Description

Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reload_future_memberships endpoint with a victim's user UUID to disclose sensitive membership information.

SeverityMedium

CVSS4.3

Exploit probability—

ProductAdmidio

PublishedAug 30, 2026

First seenAug 30, 2026

Weakness typeCWE-285CWE-285

How to fix

Update

Admidio admidio5.0.12 or later

Vendor advisories

github.com/Admidio/admidio/security/advisories/GHSA-4p3x-3rxj-v7c4

Affected products

Product	Affected versions	Fixed in
Admidio admidio	v < 5.0.12	5.0.12

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.