CVE-2026-41659

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-41659

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41659.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-41659

Aliases

GHSA-68pr-7prh-mpv4

Published

2026-05-07T02:59:19.870Z

Modified

2026-07-08T08:13:13.103986171Z

Severity

2.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member Assignment

Details

Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint (membersassignmentdata.php) includes hidden profile fields (BIRTHDAY, STREET, CITY, POSTCODE, COUNTRY) in its SQL search condition regardless of field visibility settings. While the JSON output correctly suppresses hidden columns via isVisible() checks, the server-side search operates at the SQL level before any visibility filtering. This allows a role leader with assign-only permissions to infer hidden PII values by observing which users appear in search results for specific values. This issue has been patched in version 5.0.9.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41659.json",
    "cwe_ids": [
        "CWE-200"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/admidio/admidio

Affected ranges

Type

GIT

Repo

https://github.com/admidio/admidio

Events

Introduced

Fixed

d39915697e6e0be04d02d55a46c631f53013aea6

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.0.9"
        }
    ]
}

Affected versions

3.*

3.0-Beta.1

3.0-Beta.3

v3.*

v3.0.6

v3.1.5

v3.2-Beta.1

Other

v34

v4.*

v4.0-Beta.1

v4.1-Beta.2

v4.3-Beta.1

v5.*

v5.0-Beta.1

v5.0-Beta.2

v5.0-Beta.3

v5.0.0

v5.0.1

v5.0.2

v5.0.3

v5.0.4

v5.0.5

v5.0.6

v5.0.7

v5.0.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41659.json"