CVE-2026-69090

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-69090

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69090.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-69090

Aliases

GHSA-fcq9-w4hp-xchg

Published

2026-08-03T13:20:44.304Z

Modified

2026-08-04T05:34:32.341384061Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Admidio before 5.0.11 Cross-Organization Role Modification

Details

Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations. Attackers can supply a role UUID from another organization to groups_roles.php handlers to modify that organization's roles without authorization.

Database specific

{
    "cwe_ids": [
        "CWE-862"
    ],
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69090.json"
}

References

Affected packages

Git / github.com/admidio/admidio

Affected ranges

Type

GIT

Repo

https://github.com/admidio/admidio

Events

Introduced

Fixed

a3b276bd82f7533bcddf0059f561facaf050a9aa

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.0.11"
        }
    ]
}

Affected versions

3.*

3.0-Beta.1

3.0-Beta.3

v3.*

v3.0.6

v3.1.5

v3.2-Beta.1

v4.*

v4.0-Beta.1

v4.1-Beta.2

v4.3-Beta.1

v5.*

v5.0-Beta.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69090.json"