Admidio EUVD-2026-97631

Exploitation requires the attacker to already hold role-administrator privileges within at least one organization on the Admidio instance (PR:H), and the instance must host multiple organizations so that a foreign role UUID exists to target. The concrete prerequisite is the ability to submit an assign request to members_assignment.php supplying a role UUID belonging to another organization; the flaw is the absent cross-organization authorization check on that UUID. Limiting factors: single-organization deployments have no foreign org to pivot into, and the attacker cannot be an anonymous/low-privilege user - role-admin access is mandatory, which bounds the realistic attacker population to insiders or compromised admin accounts.

This is a genuine but conditional priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N) scores 8.5 and reflects a network-reachable, low-complexity authorization flaw with high confidentiality and integrity impact - but critically requires PR:H, meaning the attacker must already hold role-administrator privileges in at least one organization. This is not a pre-authentication internet-wide risk; it is a privileged-user, cross-tenant boundary-crossing flaw (CWE-639, IDOR on a role UUID). No EPSS score, KEV listing, or POC availability was supplied in the input, so exploitation likelihood cannot be quantified from the data - status is 'no public exploit identified at time of analysis.' The CVSS and description are consistent (network vector matches the HTTP POST to members_assignment.php; PR:H matches the 'role administrators' requirement). The main caveat: the real-world threat depends entirely on multi-tenant deployments where distinct organizations share one Admidio instance and distrust each other's role admins - in single-organization installations the impact is largely moot. Treat as high-priority patching for shared/multi-org hosting, lower urgency for isolated single-tenant installs.

A user who is a role administrator in one organization on a shared multi-tenant Admidio instance submits a crafted POST to members_assignment.php referencing a role UUID belonging to a different organization. The missing cross-organization authorization check lets them assign themselves (or a confederate) into that foreign role, after which they can log into the victim organization and read or edit its user profiles. No public exploit code was supplied in the input, but the attack is a simple parameter-substitution request requiring only existing role-admin access.