CyberRota Analysis
AI-GeneratedAdmidio versions prior to 5.0.11 are vulnerable due to inadequate validation of organization membership in role handlers, enabling authenticated role administrators to manipulate roles across different organizations. This flaw allows unauthorized modifications, including deletion and activation of roles, potentially leading to privilege escalation and disruption of organizational governance. Organizations using Admidio should prioritize patching to mitigate the risk of unauthorized role management and maintain security integrity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations. Attackers can supply a role UUID from another organization to groups_roles.php handlers to modify that organization's roles without authorization.