CVE-2026-69090 — Admidio before 5.0.11 Cross-Organization Role Modification
Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit role…
Published: 2026-08-03 · CVSS: 6.9 · CVSS 4.0
Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations. Attackers can supply a role UUID from another organization to groups_roles.php handlers to modify that organization's roles without authorization.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7