CVE-2026-82658
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Aug 30, 2026
Vendor
unknown
Description
Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reload_future_memberships endpoint with a victim's user UUID to disclose sensitive membership information.