Broken Access Control in Admidio Exposes User Membership Data

Executive Summary

This is a broken access control vulnerability in Admidio versions before 5.0.12. Authenticated low-privilege users can exploit the reload_future_memberships endpoint in profile_function.php to read another user's future role memberships by directly calling it with the victim's user UUID. This bypasses profile-level authorization checks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Admidio instance is running a version prior to 5.0.12. Use the command: grep -r 'version' /path/to/admidio/config or check the version in the admin panel. Additionally, monitor network traffic for requests to profile_function.php with mode=reload_future_memberships and a user UUID parameter.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain unauthorized access to sensitive future membership details of other users. This could lead to exposure of confidential role assignments, potentially affecting organizational trust or enabling further targeted attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA due to unauthorized disclosure of sensitive membership information. GDPR requires protection of personal data, and HIPAA mandates safeguarding protected health information. Unauthorized access to future role memberships may expose personal data without consent.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Admidio to version 5.0.12 or later. If updating is not possible, restrict access to the profile_function.php file or disable the reload_future_memberships endpoint. Review logs for suspicious activity targeting this endpoint and ensure low-privilege users cannot access sensitive user data.

Useful 0 Not Useful 0