What’s Vulnerable › Vulnerabilities

CVE-2026-41659: Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member Assignment

• Severity: low (CVSS 2.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-07 · updated 2026-06-17
• Weakness: CWE-200

Description

Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint (members_assignment_data.php) includes hidden profile fields (BIRTHDAY, STREET, CITY, POSTCODE, COUNTRY) in its SQL search condition regardless of field visibility settings. While the JSON output correctly suppresses hidden columns via isVisible() checks, the server-side search operates at the SQL level before any visibility filtering. This allows a role leader with assign-only permissions to infer hidden PII values by observing which users appear in search results for specific values. This issue has been patched in version 5.0.9.

Affected products

• admidio: before 5.0.9

References

• https://github.com/Admidio/admidio/releases/tag/v5.0.9
• https://github.com/Admidio/admidio/security/advisories/GHSA-68pr-7prh-mpv4
• https://github.com/Admidio/admidio/security/advisories/GHSA-68pr-7prh-mpv4

Get alerted when CVE-2026-41659 or the next vulnerability affects your stack