Executive brief
Admidio is a member management system used by organizations to track roles, memberships, and user profiles. A flaw in its profile viewing function allows authenticated users with low privileges to view another user's future membership information by directly accessing an endpoint that bypasses normal access controls, potentially exposing sensitive organizational role assignments that should remain private.
Technical details
This is a broken access control vulnerability (CWE-285) in profile_function.php's reload_future_memberships endpoint. The vulnerability occurs because profile.php correctly enforces profile-level authorization checks via hasRightViewProfile(), but profile_function.php?mode=reload_future_memberships bypasses this check and directly returns membership data by calling getFutureRolesFromDatabase() and getRoleMemberships(), which only validate role-view rights and self-access rather than profile authorization. An authenticated low-privilege user can directly call the endpoint with a victim's user UUID to disclose future memberships (mem_begin > DATE_NOW), provided the target role is visible to the attacker. The attack requires network access and valid authentication but no user interaction. This issue is configuration-dependent and exploitable when target roles have visibility settings like "Role members / Logged in users" or the attacker has a leadership position. The vulnerability is patched in version 5.0.12 and later.
Affected products
- Admidio Admidio before 5.0.12
Timeline
- 2026-08-16: disclosed
- 2026-08-30: advisory
- 2026-08-30: patched: Version 5.0.12 and later