VULNERABILITY INTELLIGENCE
CVE-2026-82658
CVSS score4.3 MEDIUM
EPSS probability0.30%
CISA KEVNot currently listed
Published2026-08-30
Last modified2026-09-02
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reload_future_memberships endpoint with a victim's user UUID to disclose sensitive membership information.
Weakness classification
- disclosure@vulncheck.com: CWE-285