Technical impact
Admidio before version 5.0.11 contains an access control flaw in role handlers that fails to confirm the target organization of a role. This flaw allows an authenticated role administrator to delete, activate, deactivate, or edit roles that belong to other organizations by supplying an external role UUID to the groups_roles.php endpoint. The result is that a privileged user can modify roles they are not authorized to manage, potentially granting themselves or others increased permissions within another organization. The vulnerability is categorized as an improper access control weakness (CWE‑862) and can lead to unauthorized privilege escalation across organizational boundaries. Based on the description, the impact does not involve code execution or data exfiltration but rather alters the configuration and access rights of roles within the application.
Affected Systems
Admidio installations using any version prior to 5.0.11 are affected. This includes all deployments where the application’s role management feature is enabled and where users have role administrator privileges. The exact version range is "any version before 5.0.11"; no specific minor releases are listed but the official advisory states that 5.0.10 and earlier are impacted.
Risk and Exploitability
The CVSS score of 6.9 indicates a moderate severity. EPSS information is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a web-based authenticated request; an attacker must run or have credentials for a role administrator account. With that credential, the attacker can craft requests to groups_roles.php with a role UUID from another organization, thereby manipulating roles without authorization. The exploit requires no special privileges beyond those of a legitimate role administrator and does not need additional network or system access. Given the moderate severity and the need for authentication, the overall likelihood of exploitation in a targeted environment is moderate, though the impact on organizational role integrity and privilege separation could be significant.
