CVE-2026-41657: 
PHP vulnerability analysis and mitigation

CVE-2026-41657 is an incorrect authorization vulnerability in Admidio, an open-source user management solution, that allows a privileged user manager to bypass multi-tenant organization isolation and retrieve member data from all organizations in the instance. The flaw exists in the contacts_data.php endpoint, which applies a weaker permission check than the frontend UI, enabling cross-organization data exposure. It affects all versions up to and including 5.0.8, with version 5.0.9 containing the fix. The vulnerability was published to the GitHub Advisory Database on April 29, 2026, and to the NVD on May 7, 2026. It carries a CVSS v3.1 base score of 4.9 (Medium) (Github Advisory, Admidio Advisory).

The root cause is a permission check mismatch (CWE-863: Incorrect Authorization) between the frontend UI (contacts.php) and the backend data endpoint (contacts_data.php). The frontend correctly gates the "show all organizations" filter (mem_show_filter=3) behind isAdministrator() (requiring rol_administrator=true) and the contacts_show_all system setting, while the backend only checks isAdministratorUsers() (requiring rol_edit_user=true) and never validates the contacts_show_all setting. When showAllMembersDatabase=true is passed to ListConfiguration::getSql(), the generated SQL omits all cat_org_id = $gCurrentOrgId organization-scoping clauses, returning records from the entire database. An attacker with a user manager role can directly craft an HTTP GET request to contacts_data.php?mem_show_filter=3 to trigger this code path without using the frontend UI (Github Advisory, Admidio Advisory).

Successful exploitation allows a non-administrator user manager in one organization to exfiltrate the complete member directory of all other organizations sharing the same Admidio database instance. Exposed data includes full names, all configured profile fields (addresses, phone numbers, etc.), email addresses, login names, and user UUIDs. The contacts_show_all administrative setting — intended to explicitly control cross-organization visibility — is also bypassed, meaning even instances where administrators have deliberately disabled cross-org viewing are affected. There is no integrity or availability impact; the vulnerability is purely a confidentiality breach (Github Advisory).

No public exploit code or exploit kit integration has been reported beyond the proof-of-concept included in the official security advisory. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (2nd percentile), indicating a low near-term exploitation probability. Exploitation requires an authenticated session with a user manager role (rol_edit_user=true), limiting the attack surface to insider threats or compromised user manager accounts (Github Advisory).

1. Prerequisite verification: Confirm the target Admidio instance hosts multiple organizations sharing the same database, and obtain credentials for an account with rol_edit_user=1 but rol_administrator=0 in one of those organizations.
2. Authentication: Log in to the Admidio instance using the user manager account and capture the resulting PHP session cookie (PHPSESSID).
3. Direct endpoint request: Bypass the frontend UI and send a crafted HTTP GET request directly to the backend data endpoint with the cross-organization filter parameter:

curl -s -b 'PHPSESSID=<user_manager_session>' \
  'https://target/adm_program/modules/contacts/contacts_data.php?mem_show_filter=3&draw=1&start=0&length=100&search%5Bvalue%5D='

4. Data exfiltration: Parse the returned JSON response, which contains all user records from all organizations in the database — including usr_uuid, login_name, member_email, and all configured profile fields.
5. Cross-org verification: Identify users from other organizations by checking the member_this_orga field in the response; a value of 0 indicates the user belongs to a different organization than the attacker's account (Admidio Advisory).

• Network: HTTP GET requests to /adm_program/modules/contacts/contacts_data.php with the query parameter mem_show_filter=3 originating from accounts that are not full administrators (rol_administrator=0).
• Logs: Web server access logs showing requests to contacts_data.php?mem_show_filter=3 from user manager sessions; repeated or automated requests with incrementing start parameters suggesting bulk data harvesting (e.g., start=0, start=100, start=200).
• Application Behavior: JSON responses from contacts_data.php containing member_this_orga=0 entries, indicating cross-organization data was returned to a non-administrator user.

Admidio has released version 5.0.9, which patches this vulnerability by aligning the backend permission check in contacts_data.php with the frontend guard. The fix changes line 235 of modules/contacts/contacts_data.php to require both isAdministrator() and the contacts_show_all setting, matching the frontend logic. As a defense-in-depth measure, the fix also adds an early rejection block that resets mem_show_filter to 0 for unauthorized users before any SQL is generated. All Admidio deployments running version 5.0.8 or earlier — particularly those with multiple organizations — should upgrade to version 5.0.9 immediately (Admidio Release, Github Advisory).