EUVD-2026-308946

fkie_cve-2026-41657

Admidio is an open-source user management solution. Prior to version 5.0.9, the contacts_data.php endpoint uses a weaker permission check (isAdministratorUsers(), requiring only rol_edit_user=true) than the frontend UI (contacts.php) which correctly requires the stronger isAdministrator() (requiring rol_administrator=true) and the contacts_show_all system setting. A user manager who is not a full administrator can directly request contacts_data.php?mem_show_filter=3 to retrieve all user records across all organizations in the Admidio instance, bypassing multi-tenant organization isolation. This issue has been patched in version 5.0.9.

GHSA-g8p8-94f2-28gr — Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.php

Affected: Packagist: admidio/admidio

## Summary

The `contacts_data.php` endpoint uses a weaker permission check (`isAdministratorUsers()`, requiring only `rol_edit_user=true`) than the frontend UI (`contacts.php`) which correctly requires the stronger `isAdministrator()` (requiring `rol_administrator=true`) and the `contacts_show_all` system setting. A user manager who is not a full administrator can directly request `contacts_data.php?mem_show_filter=3` to retrieve all user records across all organizations in the Admidio instance, bypassing multi-tenant organization isolation.

## Details

The frontend page `contacts.php` and the backend data endpoint `contacts_data.php` have mismatched authorization checks for the "show all organizations" filter (`mem_show_filter=3`).

**Frontend guard** at `modules/contacts/contacts.php:80`: ```php if ($gCurrentUser->isAdministrator() && $gSettingsManager->getBool('contacts_show_all')) { // Only then is filter=3 ("All Organizations") shown in the dropdown $selectBoxValues = array( ... '3' => array('3', $gL10n->get('SYS_ALL_CONTACTS'), $gL10n->get('SYS_ALL_ORGANIZATIONS')) ); } ``` This correctly requires both `isAdministrator()` (`rol_administrator=true`) AND the `contacts_show_all` setting.

**Backend check** at `modules/contacts/contacts_data.php:235`: ```php } elseif (($getMembersShowFilter === 3) && $gCurrentUser->isAdministratorUsers()) { $mainSql = $contactsListConfig->getSql( array( 'showAllMembersDatabase' => true,…

Most recent entries from all

EUVD-2026-308946

fkie_cve-2026-41657

GHSA-g8p8-94f2-28gr — Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.php