CyberRota Analysis
AI-GeneratedAdmidio versions prior to 5.0.12 are vulnerable due to a broken access control issue in profile_function.php, enabling authenticated low-privilege users to access another user's future role memberships. This vulnerability allows attackers to bypass profile-level authorization and disclose sensitive membership information by directly invoking the reload_future_memberships endpoint with a victim's user UUID. Organizations using affected versions should prioritize patching to mitigate potential information disclosure risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reload_future_memberships endpoint with a victim's user UUID to disclose sensitive membership information.