CVE-2026-109329 — Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.php
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizatio…
Published: 2026-10-12 · CVSS: 8.5 · CVSS 4.0
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations. Attackers can submit crafted assign requests to members_assignment.php with a foreign role UUID to gain privileged membership, log into that organization, and edit its user profiles.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7