Vulnerability · Published Aug 3, 2026 · Assigned by VulnCheck
CVE-2026-69090Admidio before 5.0.11 Cross-Organization Role Modification
Medium 4.9
In plain English
A medium-severity missing authorization in admidio from Admidio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)0.3%top 71.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations. Attackers can supply a role UUID from another organization to groups_roles.php handlers to modify that organization's roles without authorization.
Affected products (as reported)
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
References
- GitHub Security Advisory (GHSA-fcq9-w4hp-xchg) vendor-advisory
- VulnCheck Advisory: Admidio before 5.0.11 Cross-Organization Role Modification third-party-advisory