---
id: CVE-2026-82658
title: >-
  Admidio versions before 5.0.12 contain a broken access control vulnerability
  in profile_function.php that allows authenticated low-privilege users to read
  another user's future role memberships
summary: >-
  Admidio versions before 5.0.12 contain a broken access control vulnerability
  in profile_function.php that allows authenticated low-privilege users to read
  another user's future role memberships. Attackers can bypass profile-level
  authori…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-285
published: '2026-08-30'
updated: '2026-08-30'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82658'
references:
  - url: 'https://github.com/Admidio/admidio/security/advisories/GHSA-4p3x-3rxj-v7c4'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/admidio-before-5.0.12-broken-access-control-via-profile-function-php
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-08-31T01:00:16.302Z'
epss: 0.00305
epssPercentile: 0.20727
---

## Overview

Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reload_future_memberships endpoint with a victim's user UUID to disclose sensitive membership information.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.