CVE-2026-41659 Overview
CVE-2026-41659 is an information disclosure vulnerability in Admidio, an open-source user management solution. The flaw exists in the member assignment DataTables endpoint (members_assignment_data.php) prior to version 5.0.9. The endpoint includes hidden profile fields such as BIRTHDAY, STREET, CITY, POSTCODE, and COUNTRY in its SQL search condition regardless of field visibility settings. A role leader with assign-only permissions can infer hidden personally identifiable information (PII) by observing which users appear in search results for specific values. The issue is patched in Admidio version 5.0.9.
Critical Impact
A role leader with assign-only permissions can enumerate hidden PII values, including birthdays and addresses, by observing search result membership.
Affected Products
- Admidio open-source user management solution
- Versions prior to 5.0.9
- Deployments exposing the members_assignment_data.php endpoint
Discovery Timeline
- 2026-05-07 - CVE CVE-2026-41659 published to NVD
- 2026-05-07 - Last updated in NVD database
Technical Details for CVE-2026-41659
Vulnerability Analysis
The vulnerability resides in the member assignment DataTables endpoint members_assignment_data.php. The endpoint applies search conditions at the SQL layer across all profile fields, including those marked as hidden. JSON output filters hidden columns through isVisible() checks before returning data to the client. This filtering occurs after the database has already evaluated the search predicate.
The mismatch between SQL-layer search and presentation-layer visibility creates an oracle. A role leader can submit search terms targeting hidden fields and observe whether matching users appear in the result set. By iterating through candidate values, the attacker reconstructs hidden PII without ever directly reading the field. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Exploitation requires authenticated access with role leader and assign-only permissions, limiting the attack surface to users already trusted within the application.
Root Cause
The root cause is inconsistent enforcement of field visibility between the SQL query and the JSON serializer. Visibility checks should apply to the search predicate construction, not only to output rendering. Hidden fields remain queryable, exposing their contents through inference rather than direct disclosure.
Attack Vector
An authenticated role leader sends search requests to members_assignment_data.php with values targeting hidden profile fields. The server matches these values against the hidden columns in the SQL WHERE clause. Users whose hidden fields match the search term appear in the response. The attacker correlates response membership with the submitted search value to infer the hidden data.
For technical details, refer to the GitHub Security Advisory GHSA-68pr-7prh-mpv4.
Detection Methods for CVE-2026-41659
Indicators of Compromise
- High-volume search requests to members_assignment_data.php from a single authenticated session
- Sequential or dictionary-style search parameters targeting fields like postal codes, cities, or birthdays
- Role leader accounts issuing search queries that iterate through value ranges
Detection Strategies
- Inspect web server access logs for repeated requests to members_assignment_data.php with varying search parameters
- Correlate authenticated session activity with anomalous DataTables search frequency
- Review database query logs for search predicates referencing BIRTHDAY, STREET, CITY, POSTCODE, or COUNTRY columns from non-administrative roles
Monitoring Recommendations
- Enable application-level audit logging for member assignment endpoint requests
- Track search request rates per authenticated user and alert on outliers
- Monitor role leader accounts for activity patterns inconsistent with assignment workflows
How to Mitigate CVE-2026-41659
Immediate Actions Required
- Upgrade Admidio to version 5.0.9 or later
- Audit role leader accounts and remove assign-only permissions where not required
- Review historical access logs for search activity targeting hidden profile fields
Patch Information
The issue is fixed in Admidio version 5.0.9. The patch aligns SQL-layer search behavior with the presentation-layer visibility model, excluding hidden fields from search predicates. Release notes are available at the Admidio v5.0.9 release page.
Workarounds
- Restrict role leader assignment privileges to trusted personnel only until upgrade
- Reduce the set of profile fields marked as hidden where feasible to limit exposure
- Place the Admidio installation behind a web application firewall configured to rate-limit DataTables search endpoints
# Upgrade to patched version
git fetch --tags
git checkout v5.0.9
# Or download the release archive from:
# https://github.com/Admidio/admidio/releases/tag/v5.0.9
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
