Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php that allows authenticated low-privilege users… (CVE-2026-82658)

CVE-2026-82658 describes a broken access control vulnerability in Admidio prior to version 5.0.12. Authenticated low-privilege users can bypass profile-level authorization controls by invoking the reload_future_memberships endpoint with a victim's user UUID. This allows them to read the victim's future role memberships, exposing sensitive membership data. The vulnerability is categorized under CWE-285 (Improper Authorization). The CVSS 3.1 base score is 4.3, indicating a medium severity with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, and limited confidentiality impact.

The vulnerability allows unauthorized disclosure of sensitive membership information related to users' future role memberships. It does not impact integrity or availability. The exposure is limited to confidentiality of membership data accessible to authenticated low-privilege users.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the reload_future_memberships endpoint and monitor for unauthorized access attempts if possible.