EUVD-2026-52283
GHSA-jq7q-39fg-c24g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Scope change (S:C) applies because a role admin in one organization can violate the integrity boundary of a separate organization; PR:H reflects mandatory role administrator credential.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations. Attackers can supply a role UUID from another organization to groups_roles.php handlers to modify that organization's roles without authorization.
AnalysisAI
Cross-organization role manipulation in Admidio before 5.0.11 allows authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations hosted on the same instance. The flaw exists because groups_roles.php handlers accept role UUIDs without verifying that the target role belongs to the requesting user's organization, enabling cross-tenant privilege structure sabotage. No public exploit has been identified at time of analysis; vendor-released patch version 5.0.11 is available.
Technical ContextAI
Admidio is an open-source PHP web application designed for managing members, roles, and groups within organizations, commonly used in clubs and community groups. The CPE cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:* covers all versions prior to 5.0.11. The root cause is CWE-862 (Missing Authorization): the role management handler (groups_roles.php) processes role UUIDs supplied in HTTP requests without asserting that the referenced role belongs to the authenticated user's own organization. In multi-organization Admidio deployments - where a single installation hosts multiple distinct organizations - this missing membership check creates a cross-tenant authorization boundary violation, allowing one organization's privileged user to manipulate another organization's role definitions.
RemediationAI
Upgrade Admidio to version 5.0.11 or later, which introduces proper organization membership validation in role handler requests. The vendor advisory is available at https://github.com/Admidio/admidio/security/advisories/GHSA-fcq9-w4hp-xchg. For environments that cannot immediately upgrade, restrict the role administrator privilege to the minimum number of trusted users per organization, as this is the prerequisite credential for exploitation. Additionally, if Admidio is deployed in a single-organization configuration, the cross-organization attack surface does not exist and the urgency is reduced. Network-level controls (WAF rules, IP allowlisting for the admin interface) will not fully mitigate this flaw since the attacker is already an authenticated user accessing legitimate endpoints. Patch application is the only complete fix.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today