Admidio versions prior to 5.0.11 contain a vulnerability where role handlers do not properly validate the target organization's membership. This flaw allows authenticated role administrators to manipulate roles of other organizations by supplying a role UUID from a different organization. Actions such as deleting, activating, deactivating, or editing roles can be performed without proper authorization. The vulnerability has a CVSS score of 4.9, indicating medium severity.