CVE-2026-41657: Admidio Auth Bypass Vulnerability

CVE-2026-41657 Overview

CVE-2026-41657 is a broken access control vulnerability [CWE-863] in Admidio, an open-source user management solution. The flaw exists in the contacts_data.php endpoint, which enforces a weaker permission check than its frontend counterpart contacts.php. The endpoint relies on isAdministratorUsers(), requiring only rol_edit_user=true, while the UI correctly requires isAdministrator() with rol_administrator=true and the contacts_show_all system setting. A user manager without full administrator rights can directly request contacts_data.php?mem_show_filter=3 to retrieve user records across all organizations in the instance. The issue is patched in version 5.0.9.

Critical Impact
Authenticated user managers can bypass multi-tenant organization isolation and exfiltrate contact records belonging to all organizations hosted within a single Admidio instance.

Affected Products

Admidio versions prior to 5.0.9
Multi-tenant Admidio deployments hosting multiple organizations
Admidio installations with delegated user-manager roles (rol_edit_user)

Discovery Timeline

2026-05-07 - CVE-2026-41657 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-41657

Vulnerability Analysis

Admidio enforces two distinct authorization tiers. Full administrators carry rol_administrator=true and pass isAdministrator(). User managers carry rol_edit_user=true and pass the weaker isAdministratorUsers() check. The frontend page contacts.php requires the stronger check plus the contacts_show_all system setting before exposing cross-organization contact data.

The backend data endpoint contacts_data.php skips this layered validation. It only confirms that the requester is a user manager. Because the endpoint accepts the mem_show_filter query parameter directly, a user manager can submit mem_show_filter=3 and receive the unfiltered cross-organization dataset. This breaks the tenant isolation model that Admidio promises for shared deployments.

Root Cause

The root cause is inconsistent authorization enforcement between the UI route and the data route. The frontend gate evaluates organization-scoping logic, while the AJAX/data endpoint relies on a coarser role check. The endpoint also fails to validate that the value of mem_show_filter is permissible for the calling role. This is a textbook authorization-mismatch defect tracked under CWE-863: Incorrect Authorization.

Attack Vector

Exploitation requires an authenticated session with the user-manager role. The attacker issues an HTTP GET request to contacts_data.php with the parameter mem_show_filter=3. The server returns contact records for every organization in the Admidio instance. No social engineering, user interaction, or memory corruption primitive is involved. Refer to the GitHub Security Advisory GHSA-g8p8-94f2-28gr for the maintainer-supplied technical description.

Detection Methods for CVE-2026-41657

Indicators of Compromise

HTTP requests to contacts_data.php containing mem_show_filter=3 originating from accounts that lack rol_administrator=true.
Unexpected bulk responses from contacts_data.php returning records outside the requesting user's assigned organization.
User-manager accounts accessing contact exports across multiple organization IDs in a short window.

Detection Strategies

Inspect web server access logs for the query string mem_show_filter=3 against contacts_data.php and correlate the session to the requester's role.
Compare request volume and response size on contacts_data.php against historical baselines per user.
Audit Admidio role assignments to identify accounts with rol_edit_user=true but without rol_administrator=true, then review their recent endpoint usage.

Monitoring Recommendations

Forward Admidio web access logs and PHP error logs to a centralized analytics platform for query-parameter searches.
Alert on outbound transfer spikes from the Admidio host that follow contacts_data.php requests.
Track creation of new user-manager accounts and any subsequent access to contacts_data.php within 24 hours.

How to Mitigate CVE-2026-41657

Immediate Actions Required

Upgrade all Admidio instances to version 5.0.9 or later as published in the GitHub Release v5.0.9.
Review the user-manager role roster and revoke rol_edit_user from accounts that do not require it.
Audit access logs for prior exploitation of contacts_data.php?mem_show_filter=3 and notify affected organizations if cross-tenant data was returned.

Patch Information

The maintainers fixed the issue in Admidio 5.0.9 by aligning the authorization check in contacts_data.php with the frontend. The patched endpoint now enforces isAdministrator() and the contacts_show_all system setting before returning cross-organization records. Patch details are available in the GitHub Security Advisory GHSA-g8p8-94f2-28gr.

Workarounds

Restrict access to contacts_data.php at the web server level to administrator IP ranges until the upgrade is applied.
Temporarily disable user-manager role assignments in multi-tenant deployments where cross-organization isolation is required.
Apply web application firewall rules to block requests containing mem_show_filter=3 to contacts_data.php from non-administrator sessions.

bash

# Example nginx rule blocking the vulnerable parameter pattern
location = /adm_program/modules/contacts/contacts_data.php {
    if ($arg_mem_show_filter = "3") {
        return 403;
    }
}