CVE-2026-82658 Admidio CVE debrief

Who should care

Administrators and users of Admidio versions before 5.0.12 should be aware of this vulnerability and take necessary actions to protect their installations. This includes reviewing Admidio deployments, restricting access to the reload_future_memberships endpoint, and implementing compensating controls to monitor and limit sensitive membership information disclosure. Security teams and vulnerability management teams should prioritize this issue and coordinate with Admidio administrators to ensure timely remediation.

Technical summary

The vulnerability exists in the profile_function.php file of Admidio versions before 5.0.12. An authenticated low-privilege user can bypass profile-level authorization by directly calling the reload_future_memberships endpoint with a victim's user UUID to disclose sensitive membership information. This issue allows attackers to read another user's future role memberships, potentially leading to unauthorized access or privilege escalation.

Defensive priority

Authenticated low-privilege users can exploit a broken access control vulnerability in Admidio versions before 5.0.12 to read another user's future role memberships.

Recommended defensive actions

• Inventory Admidio installations to identify versions before 5.0.12.
• Restrict access to the reload_future_memberships endpoint.
• Implement compensating controls to monitor and limit sensitive membership information disclosure.
• Apply vendor remediation when available.
• Monitor for suspicious activity related to user role memberships.

Evidence notes

The CVE-2026-82658 record indicates a broken access control vulnerability in Admidio versions before 5.0.12. Authenticated low-privilege users can exploit this issue to read another user's future role memberships by directly calling the reload_future_memberships endpoint with a victim's user UUID. The vulnerability exists in the profile_function.php file of Admidio. To verify and mitigate this issue, defenders should review Admidio installations, check for suspicious activity related to user role memberships, and apply vendor remediation when available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.