Admidio: Broken access control allows cross-organization role assignment
Summary
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contain a broken access control flaw in members_assignment.php. A role administrator of one organization can assign users to roles of another organization by supplying a foreign role UUID. The attacker can then log into that organization and edit its user profiles. Exploitation requires a role administrator account and an installation with more than one organization.
Affected
- Admidio 4.3.2 through 4.3.17
- Admidio 5.0.0 through 5.0.14
- Note: the GitHub advisory lists the affected range as 5.0.0 and later; sources do not confirm a backport to 4.3.x.
Fixed in
- Admidio 5.0.15 (named as fixed version in the CVE record and the advisory)
- No fixed 4.3.x release confirmed.
Workaround
- No vendor workaround found.
- Limit the role administrator right to trusted users.
- Review members and role memberships of each organization for unexpected assignments.
Exploitation
- Not listed as known exploited (KEV).
- EPSS score 0.00285 (low).
- No public proof of concept found; this does not rule one out.
- CISA SSVC: exploitation none, not automatable.
Our recommendation
- Update Admidio to 5.0.15 or later.
- Treat 4.3.x installations as vulnerable until the vendor confirms a fix.
- Restrict the role administrator right to necessary users only.
- Check role memberships in all organizations for unexpected entries.
- Monitor audit logs for role assignment changes, if enabled.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-ggch-5cpv-rvqx github.com
- VulnCheck Advisory www.vulncheck.com
- OSV CVE-2026-109329 osv.dev
- HOL Guard CVE-2026-109329 hol.org
- Admidio Releases github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:53.
Original description (NVD)
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations. Attackers can submit crafted assign requests to members_assignment.php with a foreign role UUID to gain privileged membership, log into that organization, and edit its user profiles.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.