CVE-2026-41659: 
PHP vulnerability analysis and mitigation

CVE-2026-41659 is a hidden profile field information disclosure vulnerability in Admidio, an open-source user management solution. The flaw exists in the member assignment DataTables endpoint (members_assignment_data.php), where hidden profile fields (BIRTHDAY, STREET, CITY, POSTCODE, COUNTRY) are included in SQL search conditions regardless of field visibility settings, enabling a blind search oracle attack. It affects all Admidio versions up to and including 5.0.8, and was patched in version 5.0.9 released on April 18, 2026. The advisory was published on April 23, 2026, with CVE assignment on May 7, 2026. It carries a CVSS v3.1 base score of 2.7 (Low) (GitHub Advisory, Admidio Release).

The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), arising from a mismatch between SQL-level search filtering and application-level visibility controls. In modules/groups-roles/members_assignment_data.php (lines 118–126), the $searchColumns array hardcodes hidden fields (birthday, street, city, zip_code, country) without any visibility check, and these are concatenated into a SQL LIKE search condition (line 139) applied before any output filtering. While the JSON response correctly suppresses hidden columns via isVisible() checks, the database query has already filtered the result set using those hidden values. An authenticated role leader with ROLE_LEADER_MEMBERS_ASSIGN (assign-only) permissions — the lowest leader privilege level — can exploit this by submitting targeted search queries and observing which user names appear in the filtered results, effectively inferring hidden PII values through a blind oracle technique (GitHub Advisory).

Successful exploitation allows a role leader with minimal privileges to enumerate hidden personally identifiable information (PII) for all organization members, including exact dates of birth, full street addresses, cities, postal codes, and countries. Although hidden field values are never directly returned in the JSON response, the attacker can determine which users match any specific hidden field value by observing the filtered result set and recordsFiltered count. This defeats the administrator's intent in marking profile fields as hidden and constitutes a privacy violation, particularly relevant under data protection regulations such as GDPR. There is no integrity or availability impact (GitHub Advisory).

A proof-of-concept (PoC) is publicly documented in the GitHub Security Advisory, demonstrating exploitation via simple authenticated HTTP GET requests to the members_assignment_data.php endpoint with crafted search[value] parameters. Exploitation requires a valid session as a role leader with assign-only permissions — a relatively low bar within an organization using Admidio. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.021% (0.000210), reflecting very low likelihood of automated exploitation (GitHub Advisory).

1. Authenticate as a role leader: Log in to the Admidio instance with an account that has ROLE_LEADER_MEMBERS_ASSIGN (assign-only) permissions for at least one role. Obtain a valid PHPSESSID session cookie.
2. Identify the target role UUID: Navigate the Admidio interface or inspect network requests to obtain the UUID of the role whose members you wish to enumerate.
3. Establish a baseline: Send a request to the member assignment endpoint without a search filter to obtain the full member list and total recordsFiltered count:

   curl -b 'PHPSESSID=<session>' 'https://target/adm_program/modules/groups-roles/members_assignment_data.php?role_uuid=<uuid>&draw=1&start=0&length=25&search%5Bvalue%5D='

4. Search for a specific hidden field value: Submit a search query with a candidate PII value (e.g., a birthday date or street address fragment):

   curl -b 'PHPSESSID=<session>' 'https://target/adm_program/modules/groups-roles/members_assignment_data.php?role_uuid=<uuid>&draw=1&start=0&length=25&search%5Bvalue%5D=1990-03-15'

5. Observe the filtered result set: The JSON response will show only users whose hidden fields match the search value. The visible user names (always returned) reveal which members have that hidden PII value, even though the hidden field itself is not present in the output.
6. Enumerate additional values: Repeat with different candidate values (e.g., street addresses, postal codes) to systematically extract hidden PII for all members via this blind oracle technique (GitHub Advisory).

• Network: Repeated HTTP GET requests to /adm_program/modules/groups-roles/members_assignment_data.php with varying search[value] parameters containing date strings (e.g., YYYY-MM-DD), address fragments, postal codes, or country names from a single authenticated session.
• Logs: Web server access logs showing a high volume of requests to members_assignment_data.php with systematically varying search[value] query parameters from the same IP or session, particularly with values that do not correspond to visible profile fields.
• Logs: Application or authentication logs showing a role leader account making an unusually large number of search queries to the member assignment endpoint in a short time window.

Admidio has released version 5.0.9, which patches this vulnerability by filtering search columns based on field visibility before constructing the SQL search condition. The fix ensures that hidden fields are excluded from the $searchColumns array unless the current user has administrator privileges and the field is configured as visible. All Admidio installations running version 5.0.8 or earlier should upgrade to 5.0.9 immediately. No configuration-based workaround is available short of revoking role leader assign permissions from untrusted users (Admidio Release, GitHub Advisory).