Admidio Role Permission Bypass via Unauthorized Role UUID Manipulation

Executive Summary

Admidio before version 5.0.11 has a flaw where role handlers do not validate if a user belongs to the target organization. This allows authenticated role administrators to modify roles in other organizations by supplying a role UUID from a different organization to groups_roles.php handlers.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by reviewing logs for unauthorized modifications to roles in Admidio, particularly actions targeting organizations where the user is not a member. Check groups_roles.php handler logs for requests with role UUIDs from other organizations.

Useful 0 Not Useful 0

Impact Analysis

An attacker with role administrator privileges could delete, activate, deactivate, or edit roles in organizations they do not belong to. This could disrupt role management, grant unauthorized access, or remove legitimate roles without permission.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized modifications of role permissions across organizations, potentially violating data access controls required by GDPR and HIPAA. Unauthorized role changes may result in improper data handling or access, compromising compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Admidio to version 5.0.11 or later to patch the vulnerability. Review and audit role permissions and organization memberships for any unauthorized changes. Restrict role administrator privileges to prevent misuse.

Useful 0 Not Useful 0