Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 09:51:30 +0000 CVE-2026-82658 — Admidio before 5.0.12 Broken Access Control via profile_function.php https://vulnerability.circl.lu/vuln/cve-2026-82658 <p><strong>Affected:</strong> admidio</p> <p>Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php that allows authenticated low-privilege users to read another user&#39;s future role memberships. Attackers can bypass profile-level authorization by directly calling the reload_future_memberships endpoint with a victim&#39;s user UUID to disclose sensitive membership information.</p> <p><strong>Affected:</strong> admidio</p> <p>Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php that allows authenticated low-privilege users to read another user&#39;s future role memberships. Attackers can bypass profile-level authorization by directly calling the reload_future_memberships endpoint with a victim&#39;s user UUID to disclose sensitive membership information.</p> https://vulnerability.circl.lu/vuln/cve-2026-82658