CVE-2026-82658

The record

Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reload_future_memberships endpoint with a victim's user UUID to disclose sensitive membership information.

Affected packages

Related vulnerabilities

• CVE-2026-85543 Some Wi-Fi series camera products have insufficient permission validation on certain… CWE-285
• CVE-2026-21097 Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1… CWE-285
• CVE-2026-86804 A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. CWE-285
• CVE-2026-86277 A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Management &… CWE-285
• CVE-2026-86283 MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp)… CWE-285
• CVE-2026-86212 A vulnerability has been found in Open5GS 2.7.7/2.8.0. CWE-285
• CVE-2026-86183 A vulnerability was identified in diem-project diem up to 5.1.3. CWE-285
• CVE-2026-53602 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. CWE-285