The flaw is a blind SQL injection (CWE-89) that allows unauthenticated attackers to supply a malicious value for the relation_type_list parameter in lists_show.php. By sending a dummy UUID in role_list, an attacker can bypass the normal authentication mechanisms and execute arbitrary SQL statements. The resulting data leakage can include password hashes, user credentials, and other sensitive database content, which directly compromises confidentiality.

Admidio installations running any version prior to 5.0.12 are affected. The vulnerability is present in the community edition of the software, which is widely deployed by small and medium enterprises, though it may also affect other editions; this inference is based on the absence of explicit vendor distinction. No other vendors or product lines are known to be impacted.

The CVSS score of 8.7 signals a high likelihood of successful exploitation and a severe impact on data integrity and confidentiality. Although no EPSS score is available and the vulnerability is not yet listed in the CISA KEV catalog, the combination of blind injection and authentication bypass makes the problem generally exploitable by any actor who can send HTTP requests to lists_show.php. The attack likely involves sending a crafted request that injects SQL through relation_type_list while using a dummy UUID for role_list to circumvent authentication.