In Admidio the member assignment search endpoint uses an SQL condition that includes hidden profile fields such as birthday, street, city, postcode, and country without respecting visibility settings. Although the JSON response masks these values, the database query itself filters by them. This allows a role leader with only assign‑only permissions to infer hidden personal data by observing which users appear for specific search terms. The flaw is a confidentiality breach identified as CWE‑200.

Affected is the open‑source Admidio user management system, version 5.0.8 and earlier. The issue has been fixed in version 5.0.9 and later releases.

The CVSS score of 2.7 classifies the vulnerability as low severity; no EPSS score is available and the issue is not listed in CISA KEV. Exploitation requires legitimate access to the application as a role leader with assign‑only rights. The attacker can repeatedly query the search endpoint with particular values and observe the presence or absence of users in the result set, thereby deducing hidden PII. While remote exploitation is limited to authenticated users with those specific permissions, the inferred data can be sensitive and violates privacy expectations.