CVE-2026-109329 Admidio CVE debrief

Who should care

Defenders who manage Admidio installations, especially those with role administrators, should assess their exposure and prioritize patching or mitigating this vulnerability. This includes reviewing and restricting role administrator access, monitoring user assignments, and implementing additional security controls to prevent unauthorized access and privilege escalation. Security teams and vulnerability management teams should also be aware of this issue to

Why it matters

CVE-2026-109329 is a high-severity vulnerability in Admidio that allows role administrators to assign users to roles in other organizations, potentially leading to unauthorized access and privilege escalation. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where role administrators have elevated privileges.

• Potential unauthorized access to sensitive information
• Possible privilege escalation for attackers
• Need for defenders to verify and restrict role administrator access
• Requirement for defenders to monitor and audit user assignments

Technical summary

The vulnerability is caused by a broken access control mechanism in Admidio, which allows role administrators to assign users to roles in other organizations. This can be exploited by submitting crafted assign requests to members_assignment.php with a foreign role UUID. The vulnerability affects Admidio versions 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where role administrators have elevated privileges, to prevent potential security breaches.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where role administrators have elevated privileges.

Recommended defensive actions

• Patch or upgrade Admidio to a version that is not vulnerable
• Restrict access to role administrators and monitor their activity
• Implement additional security controls to prevent unauthorized access and privilege escalation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the CVE Program record and the NVD vulnerability detail page. The source item provides additional information about the vulnerability, including affected versions and potential attack vectors.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.