Broken Access Control in Admidio Allows Privilege Escalation

Executive Summary

Admidio versions 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 have a broken access control flaw in members_assignment.php. Role administrators can assign users to roles in other organizations by submitting crafted requests with a foreign role UUID, bypassing organizational boundaries. This allows unauthorized privilege escalation and cross-organization access.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized role assignments across organizations by reviewing logs for members_assignment.php requests with foreign role UUIDs. Inspect database entries for unexpected cross-organization role changes.

Useful 0 Not Useful 0

Impact Analysis

Attackers with role administrator privileges in one organization can exploit this to gain access to another organization. They can log in, edit user profiles, and perform privileged actions, potentially leading to data breaches or unauthorized modifications within the target organization.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements for GDPR and HIPAA. It may result in unauthorized data exposure, access control failures, and failure to protect sensitive user information, potentially leading to legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Admidio to version 5.0.15 or later. If using 4.3.x, upgrade to 4.3.18 or later. Remove unnecessary role administrator privileges until patched.

Useful 0 Not Useful 0