CVE-2026-109329 in Admidio
Summary
by MITRE • 10/12/2026
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations. Attackers can submit crafted assign requests to members_assignment.php with a foreign role UUID to gain privileged membership, log into that organization, and edit its user profiles.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
Admidio versions 4.3.2 through 4.3.17 and version 5.0.0 prior to patch level 5.0.15 are affected by a critical broken access control vulnerability within the role management subsystem. This flaw stems from insufficient server-side validation of organizational boundaries when processing user assignment requests. Specifically, the application fails to verify that the target role belongs to the same organization as the requesting administrator or the assigned users. Consequently, an attacker with administrative privileges in one organization can exploit this logic error to assign themselves or other unauthorized accounts to roles belonging to a completely different, isolated organization within the multi-tenant environment.
The technical mechanism of exploitation involves submitting crafted HTTP requests to the members_assignment.php endpoint. By manipulating the request parameters to include a Universally Unique Identifier (UUID) corresponding to a role in a foreign organization, the attacker bypasses standard authorization checks. The application processes this assignment without validating that the role UUID is associated with the current context or tenant ID of the administrator making the change. This lack of strict boundary enforcement allows for privilege escalation across organizational silos, effectively breaking the isolation model intended by the software architecture.
The operational impact of this vulnerability is severe, as it grants attackers unauthorized access to sensitive data and administrative capabilities within other organizations. Once an attacker successfully assigns themselves to a privileged role in another organization, they can authenticate using their credentials under that new context. This enables them to view confidential information belonging to unrelated entities, modify user profiles, alter organizational settings, and potentially escalate privileges further if the target roles carry higher levels of authority. In multi-tenant deployments where data segregation is critical for compliance and security, this represents a significant breach of confidentiality and integrity.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, specifically regarding the failure to enforce proper authorization checks during role assignment operations. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, as attackers leverage legitimate administrative credentials in one context to gain unauthorized access and elevated privileges in another. The flaw highlights a common pitfall in multi-tenant applications where session or request contexts are not strictly bound to the specific tenant resources being accessed.
To mitigate this risk, organizations running affected versions of Admidio must immediately upgrade to version 5.0.15 or later, which includes patches for these access control checks. For systems that cannot be updated instantly due to operational constraints, implementing a Web Application Firewall (WAF) rule to monitor and restrict requests to the members_assignment.php endpoint may provide temporary relief by blocking suspicious UUID patterns associated with cross-tenant assignments. Additionally, administrators should review audit logs for any unusual role assignment activities involving foreign organization identifiers and revoke unauthorized access immediately if detected. Regular security assessments focusing on multi-tenancy isolation are recommended to ensure that similar logic flaws do not exist in other parts of the application.