What is GHSA-7mr9-2w6x-hw8r?

GHSA-7mr9-2w6x-hw8r is a security advisory published by GitHub Security Advisories with Medium severity. Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function...

Which CVE IDs does GHSA-7mr9-2w6x-hw8r cover?

GHSA-7mr9-2w6x-hw8r covers the following CVE IDs: CVE-2026-82658. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7mr9-2w6x-hw8r?

GHSA-7mr9-2w6x-hw8r has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-7mr9-2w6x-hw8rMediumCVSS 4.3

Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function...

Vendor

GitHub Security Advisories

Published

August 30, 2026

Last Modified

August 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-82658 →

📋 Description

Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reload_future_memberships endpoint with a victim's user UUID to disclose sensitive membership information.

🔗 References (4)

https://github.com/Admidio/admidio/security/advisories/GHSA-4p3x-3rxj-v7c4
https://nvd.nist.gov/vuln/detail/CVE-2026-82658
https://www.vulncheck.com/advisories/admidio-before-5.0.12-broken-access-control-via-profile-function-php
https://github.com/advisories/GHSA-7mr9-2w6x-hw8r