Is CVE-2026-82658 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82658 being exploited in the wild.

How severe is CVE-2026-82658?

Medium severity, with a CVSS score of 4.3, published 30 August 2026.

Is there a fix for CVE-2026-82658?

A patch was published on 2026-08-30: Version 5.0.12 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82658 attacked?

It is attacked over the network.

Am I affected by CVE-2026-82658?

Check whether you run Admidio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82658: Admidio broken access control in profile_function.php

CVE-2026-82658 · Severity: medium · CVSS 4.3 · Published 2026-08-30

Admidio is a member management system used by organizations to track roles, memberships, and user profiles. A flaw in its profile viewing function allows authenticated users with low privileges to view another user's future membership information by directly accessing an endpoint that bypasses normal access controls, potentially exposing sensitive organizational role assignments that should remain private.

Technologies: Admidio. Vendors: Admidio.

Quick answers

Is CVE-2026-82658 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82658 being exploited in the wild.
How severe is CVE-2026-82658?: Medium severity, with a CVSS score of 4.3, published 30 August 2026.
Which products and versions are affected?: Admidio before 5.0.12.
Is there a fix for CVE-2026-82658?: A patch was published on 2026-08-30: Version 5.0.12 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82658 attacked?: It is attacked over the network.
Am I affected by CVE-2026-82658?: Check whether you run Admidio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a broken access control vulnerability (CWE-285) in profile_function.php's reload_future_memberships endpoint. The vulnerability occurs because profile.php correctly enforces profile-level authorization checks via hasRightViewProfile(), but profile_function.php?mode=reload_future_memberships bypasses this check and directly returns membership data by calling getFutureRolesFromDatabase() and getRoleMemberships(), which only validate role-view rights and self-access rather than profile authorization. An authenticated low-privilege user can directly call the endpoint with a victim's user UUID to disclose future memberships (mem_begin > DATE_NOW), provided the target role is visible to the attacker. The attack requires network access and valid authentication but no user interaction. This issue is configuration-dependent and exploitable when target roles have visibility settings like "Role members / Logged in users" or the attacker has a leadership position. The vulnerability is patched in version 5.0.12 and later.

Affected products

Admidio Admidio before 5.0.12

Timeline

2026-08-16: disclosed
2026-08-30: advisory
2026-08-30: patched: Version 5.0.12 and later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.