Admidio versions 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contain a broken access control flaw that allows organization administrators to assign users to roles in other organizations. By crafting a request to members_assignment.php with a role UUID that belongs to a different organization, an attacker can gain privileged membership, log into that organization, and modify its user profiles. The vulnerability stems from CWE‑639, which involves improper verification of authorization for a privileged operation.

The affected product is Admidio, marked as Admidio:admidio. Affected releases include all editions from 4.3.2 to 4.3.17 and the 5.0.0 series up to but not including 5.0.15. No further vendor or version details are provided beyond these ranges.

The CVSS score of 8.5 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalogue. Based on the description, the likely attack vector is a web request to members_assignment.php that includes a foreign role UUID; the flaw allows escalation to privileged access within the targeted organization.