Admidio’s contacts_data.php endpoint performed a weaker authorization check than the other parts of the application. It only required the rol_edit_user permission, which is granted to user managers, whereas the UI page contacts.php correctly requires full administrator status. Because an attacker who has user‑manager rights can directly call contacts_data.php with the mem_show_filter parameter set to 3, they can retrieve all user records across every organization in the instance, bypassing the intended multi‑tenant isolation. This vulnerability results in an unauthorized disclosure of member data, potentially exposing personally identifying information and other sensitive attributes to users with limited administrative privileges.

The affected product is Admidio (open‑source user management). All releases prior to v5.0.9 are vulnerable. The official fix is included in Admidio v5.0.9 and later versions.

The CVSS score is 4.9, classifying the issue as moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers must be able to reach the Admidio instance over HTTP/HTTPS to issue the request to contacts_data.php and provide a valid session token for a user manager. Because no automated exploit is documented, the practical likelihood of exploitation depends on the organization’s exposure of the endpoint and the distribution of the user‑manager role. Nevertheless, the data exposure risk merits remediation in any production deployment.