Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users… (CVE-2026-109329)

The vulnerability in Admidio affects versions 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15. It is a broken access control issue (CWE-639) that permits role administrators to escalate privileges across organizational boundaries. By sending specially crafted requests to members_assignment.php containing foreign role UUIDs, an attacker can assign themselves or others to roles in organizations they do not belong to. This enables unauthorized access and modification of user profiles in those organizations.

Successful exploitation allows attackers with role administrator privileges in one organization to gain privileged membership in other organizations, bypassing intended access controls. This leads to unauthorized access and modification of user profiles in those organizations, impacting confidentiality and integrity. Availability is not affected. The CVSS 3.1 base score is 6.5 (High), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict role administrator privileges carefully and monitor for suspicious assignment requests involving foreign role UUIDs.