TI-2026-30177 Aliases CVE-2026-41659 GHSA-68pr-7prh-mpv4

Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member Assignment

MEDIUM 47CWE-200Published 2026-05-07 · Updated 2026-05-07

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint (members_assignment_data.php) includes hidden profile fields (BIRTHDAY, STREET, CITY, POSTCODE, COUNTRY) in its SQL search condition regardless of field visibility settings. While the JSON output correctly suppresses hidden columns via isVisible() checks, the server-side search operates at the SQL level before any visibility filtering. This allows a role leader with assign-only permissions to infer hidden PII values by observing which users appear in search results for specific values. This issue has been patched in version 5.0.9.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00258 17th percentileScored 2026-11-07

Fix Fixed admidio (Admidio): 5.0.9admidio/admidio (Packagist): 5.0.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Admidio	admidio	before 5.0.9	5.0.9	Patch available	CNA
—	admidio/admidio (Packagist)	before 5.0.9	5.0.9	Patch available	GHSA-68pr-7prh-mpv4

admidio VendorAdmidio Affected before 5.0.9 Fixed in 5.0.9 Patch available CNA
admidio/admidio (Packagist) Vendor— Affected before 5.0.9 Fixed in 5.0.9 Patch available GHSA-68pr-7prh-mpv4

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:admidio:admidio::::::::	—	—	Admidio

cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:* Versions — — ·Admidio

Remediation

Fix · CNA admidio (Admidio) Fixed in 5.0.9
Fix · GHSA-68pr-7prh-mpv4 admidio/admidio (Packagist) Fixed in 5.0.9 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-41659
2026-10-03 Alias added: GHSA-68pr-7prh-mpv4

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-41659

Other 3

TI-2026-25286 Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion CVSS 3.1CRITICAL 9.1
TI-2026-56995 Admidio before 5.0.12 Authentication Bypass via RSS feeds CVSS 4.0HIGH 8.7
TI-2026-56993 Admidio before 5.0.12 SQL Injection via relation_type_list CVSS 4.0HIGH 8.7
TI-2024-25222 Admidio has Blind SQL Injection in ecard_send.php CVSS 3.1CRITICAL 10.0
TI-2026-30186 Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed CVSS 3.1HIGH 8.2
TI-2024-25764 Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment CVSS 3.1CRITICAL 9.1

See all 72 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences