https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T04:49:50.917252+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-308946 EUVD-2026-308946 2026-10-15T04:49:50.967211+00:00 EUVD-2026-308946 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41657 fkie_cve-2026-41657 2026-10-15T04:49:50.967261+00:00

Admidio is an open-source user management solution. Prior to version 5.0.9, the contacts_data.php endpoint uses a weaker permission check (isAdministratorUsers(), requiring only rol_edit_user=true) than the frontend UI (contacts.php) which correctly requires the stronger isAdministrator() (requiring rol_administrator=true) and the contacts_show_all system setting. A user manager who is not a full administrator can directly request contacts_data.php?mem_show_filter=3 to retrieve all user records across all organizations in the Admidio instance, bypassing multi-tenant organization isolation. This issue has been patched in version 5.0.9.

 https://cve.radiocsirt.org/vuln/ghsa-g8p8-94f2-28gr GHSA-g8p8-94f2-28gr — Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.php 2026-10-15T04:49:50.967299+00:00

Affected: Packagist: admidio/admidio

## Summary

The `contacts_data.php` endpoint uses a weaker permission check (`isAdministratorUsers()`, requiring only `rol_edit_user=true`) than the frontend UI (`contacts.php`) which correctly requires the stronger `isAdministrator()` (requiring `rol_administrator=true`) and the `contacts_show_all` system setting. A user manager who is not a full administrator can directly request `contacts_data.php?mem_show_filter=3` to retrieve all user records across all organizations in the Admidio instance, bypassing multi-tenant organization isolation.

## Details

The frontend page `contacts.php` and the backend data endpoint `contacts_data.php` have mismatched authorization checks for the "show all organizations" filter (`mem_show_filter=3`).

**Frontend guard** at `modules/contacts/contacts.php:80`: ```php if ($gCurrentUser->isAdministrator() && $gSettingsManager->getBool('contacts_show_all')) { // Only then is filter=3 ("All Organizations") shown in the dropdown $selectBoxValues = array( ... '3' => array('3', $gL10n->get('SYS_ALL_CONTACTS'), $gL10n->get('SYS_ALL_ORGANIZATIONS')) ); } ``` This correctly requires both `isAdministrator()` (`rol_administrator=true`) AND the `contacts_show_all` setting.

**Backend check** at `modules/contacts/contacts_data.php:235`: ```php } elseif (($getMembersShowFilter === 3) && $gCurrentUser->isAdministratorUsers()) { $mainSql = $contactsListConfig->getSql( array( 'showAllMembersDatabase' => true,…