CVE-2026-109329Medium· 6.5▾ SunlitAdmidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations. Attackers can submit crafted assign requests to members_…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations. Attackers can submit crafted assign requests to members_assignment.php with a foreign role UUID to gain privileged membership, log into that organization, and edit its user profiles.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111912Medium· 6.5Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update
CVE-2026-47230Medium· 6.5Admidio is an open-source user management solution
CVE-2026-47227Medium· 6.5Admidio is an open-source user management solution
CVE-2026-117554Medium· 4.3Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php
CVE-2026-111914Medium· 6.5Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php
CVE-2026-111913Medium· 4.3Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php