Description
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations. Attackers can submit crafted assign requests to members_assignment.php with a foreign role UUID to gain privileged membership, log into that organization, and edit its user profiles.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Admidio admidio
Default version status: unaffected
4.3.2 to ≤ 4.3.17affected5.0.0 to < 5.0.15affected5.0.15unaffected