Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Admidio is an open-source user management solution. Prior to version 5.0.9, the contacts_data.php endpoint uses a weaker permission check (isAdministratorUsers(), requiring only rol_edit_user=true) than the frontend UI (contacts.php) which correctly requires the stronger isAdministrator() (requiring rol_administrator=true) and the contacts_show_all system setting. A user manager who is not a full administrator can directly request contacts_data.php?mem_show_filter=3 to retrieve all user records across all organizations in the Admidio instance, bypassing multi-tenant organization isolation. This issue has been patched in version 5.0.9.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-41657 Admidio is an open-source user management solution. Prior to version 5.0.9, the contacts_data.php endpoint uses a weaker permission check (isAdministratorUsers(), req… https://www.cve.org/CVERecord?id=CVE-2026-41657
Post summary
The post announces that Admidio’s contacts_data.php endpoint has a weaker permission check prior to version 5.0.9, revealing a potential authorization bypass vulnerability.
⚡ New CVE Alert: CVE-2026-41657 📊 Severity: 4.9 🚨 Risk Level: Medium 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-41657 #CVE-2026-41657 #CVE #Medium #CyberSecurity #InfoSec https://t.co/8wTRpHczlH
Post summary
The post is a brief, informational alert for CVE-2026-41657, providing only its severity and an NVD link, without additional technical, exploit, or mitigation details.
CVE-2026-41657 Unauthorized Data Access in Admidio Prior to Version 5.0.9 via Weak Permission Checks https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41657
Post summary
Admidio versions before 5.0.9 have a weak permission check that can lead to unauthorized data access, as identified by CVE-2026-41657.