CVE-2026-109329

{
  "etk_id": "ETK-2026-2566",
  "cve_id": "CVE-2026-109329",
  "display_id": "CVE-2026-109329",
  "ghsa_id": "GHSA-ggch-5cpv-rvqx",
  "euvd_id": "EUVD-2026-97631",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Cross-organization role assignment access control in Admidio",
  "summary": "Admidio multi-organization deployments allow a role administrator in one organization to add users to roles belonging to another organization. This can give the attacker membership and privileges in the other organization, potentially allowing them to access or modify user data there. Exploitation requires an authenticated account with role-administration permissions in a separate organization.",
  "mitigation": "Upgrade the Admidio Composer package to version 5.0.15 or later. Until upgrading, restrict role-administration permissions and limit access to multi-organization installations.",
  "vendor": "Admidio",
  "product": "admidio",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 5.0.0"
      ],
      "ecosystem": "composer",
      "fixed_versions": [
        "5.0.15"
      ],
      "package_name": null,
      "purl": null
    }
  ],
  "cwes": [
    639
  ],
  "cvss_score": 8.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 81.75992113333334,
  "t0_at": "2026-10-12T16:05:19.232000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-09-22T20:18:09+00:00",
      "days": -19.82442398148148,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T16:05:19.232000+00:00",
      "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-ggch-5cpv-rvqx"
    },
    "trigger_signal": {
      "at": "2026-10-12T16:05:19.232000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T16:05:19.232000+00:00",
      "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-ggch-5cpv-rvqx"
    }
  }
}