PT-2026-37141 · Admidio · Admidio

Offset · Published 2026-04-29 · Updated 2026-05-07 · CVE-2026-41657

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.9

Description An authorization mismatch exists between the frontend UI and the backend data endpoint. While the frontend correctly restricts the "show all organizations" filter to full administrators, the 'contacts data.php' endpoint uses a weaker permission check via the isAdministratorUsers() function, which only requires the rol edit user permission. This allows a user manager who is not a full administrator to bypass multi-tenant organization isolation by directly requesting the 'contacts data.php' endpoint with the mem show filter variable set to 3. Consequently, an attacker can retrieve all user records across all organizations in the instance, including full names, email addresses, login names, and user UUIDs, even if the contacts show all system setting is disabled.

Recommendations Update to version 5.0.9. As a temporary workaround, restrict access to the 'contacts data.php' endpoint or monitor for requests containing the mem show filter variable set to 3 from non-administrator accounts.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-41657

GHSA-G8P8-94F2-28GR

Affected Products

Admidio

References · 8

• 🔥 https://github.com/Admidio/admidio/security/advisories/GHSA-g8p8-94f2-28gr · Exploit
• https://osv.dev/vulnerability/GHSA-g8p8-94f2-28gr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41657 · Security Note
• https://github.com/Admidio/admidio/releases/tag/v5.0.9 · Note
• https://github.com/Admidio/admidio · Note
• https://twitter.com/CVEarity/status/2052390408945340721 · Twitter Post
• https://twitter.com/CVEnew/status/2052400851814416393 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2052317675704009096 · Twitter Post