CVE-2026-69090: Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles b
Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations. Attackers can supply a role UUID from another organization to groups_roles.php handlers to modify that organization's roles without authorization.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-69090
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-69090 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for Admidio
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- mediumCVE-2026-69094: Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the save_t…nvd · 2026-08-03
- mediumCVE-2026-69093: Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferen…nvd · 2026-08-03
- mediumCVE-2026-69092: Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the S…nvd · 2026-08-03
- highCVE-2026-69091: Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when…nvd · 2026-08-03
- mediumGHSA-hm42-q32m-vj4f: Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requestsghsa · 2026-07-09
More from NVD Recent CVEs
- unknownCVE-2026-69153: PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming t…2026-08-03
- highCVE-2026-69152: The brace-expansion library generates arbitrary strings containing a common prefix and suffix.…2026-08-03
- unknownCVE-2026-69151: Angular is a development platform for building mobile and desktop web applications using TypeS…2026-08-03
- unknownCVE-2026-69149: Angular is a development platform for building mobile and desktop web applications using TypeS…2026-08-03
- unknownCVE-2026-68945: Angular is a development platform for building mobile and desktop web applications using TypeS…2026-08-03