https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T02:19:18.124315+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-308987 EUVD-2026-308987 2026-10-15T02:19:18.176528+00:00 EUVD-2026-308987 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41659 fkie_cve-2026-41659 2026-10-15T02:19:18.176573+00:00

Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint (members_assignment_data.php) includes hidden profile fields (BIRTHDAY, STREET, CITY, POSTCODE, COUNTRY) in its SQL search condition regardless of field visibility settings. While the JSON output correctly suppresses hidden columns via isVisible() checks, the server-side search operates at the SQL level before any visibility filtering. This allows a role leader with assign-only permissions to infer hidden PII values by observing which users appear in search results for specific values. This issue has been patched in version 5.0.9.

 https://cve.radiocsirt.org/vuln/ghsa-68pr-7prh-mpv4 GHSA-68pr-7prh-mpv4 — Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment 2026-10-15T02:19:18.176623+00:00

Affected: Packagist: admidio/admidio

## Summary

The member assignment DataTables endpoint (`members_assignment_data.php`) includes hidden profile fields (BIRTHDAY, STREET, CITY, POSTCODE, COUNTRY) in its SQL search condition regardless of field visibility settings. While the JSON output correctly suppresses hidden columns via `isVisible()` checks, the server-side search operates at the SQL level before any visibility filtering. This allows a role leader with assign-only permissions to infer hidden PII values by observing which users appear in search results for specific values.

## Details

The search columns are hardcoded at `modules/groups-roles/members_assignment_data.php:118-126`:

```php $searchColumns = array( 'COALESCE(last_name, \' \')', 'COALESCE(first_name, \' \')', 'COALESCE(birthday, \' \')', // hidden field - no visibility check 'COALESCE(street, \' \')', // hidden field - no visibility check 'COALESCE(city, \' \')', // hidden field - no visibility check 'COALESCE(zip_code, \' \')', // hidden field - no visibility check 'COALESCE(country, \' \')' // hidden field - no visibility check ); ```

These columns are concatenated into a SQL LIKE search at line 139:

```php $searchCondition .= ' AND LOWER(CONCAT(' . implode(', ', $searchColumns) . ')) LIKE LOWER(CONCAT(\'%\', ' . $searchValue . ', \'%\')) '; ```

The SQL query at lines 200-235 fetches all these fields via LEFT JOINs on `adm_user_data`, and the search condition is applied as a subquery filt…