github.com
https://github.com/Admidio/admidio CVE-2026-41659
LOW
Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member Assignment
Record summary
CVE-2026-41659 has a selected CVSS score of 2.7 (low).
Description
Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint (members_assignment_data.php) includes hidden profile fields (BIRTHDAY, STREET, CITY, POSTCODE, COUNTRY) in its SQL search condition regardless of field visibility settings. While the JSON output correctly suppresses hidden columns via isVisible() checks, the server-side search operates at the SQL level before any visibility filtering. This allows a role leader with assign-only permissions to infer hidden PII values by observing which users appear in search results for specific values. This issue has been patched in version 5.0.9.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated May 7, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
admidioBrowse Admidio / admidio | CVE List | < 5.0.9 | affected |
admidio/admidioBrowse Packagist / admidio/admidio | GitHub Advisory | Before 5.0.9 · Fixed in 5.0.9 | affected |
References
4github.com
https://github.com/Admidio/admidio/releases/tag/v5.0.9 github.comConfirmation
https://github.com/Admidio/admidio/security/advisories/GHSA-68pr-7prh-mpv4 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-41659