CVE-2026-82655

Admidio before 5.0.12, an open-source membership and association management platform, contains a blind SQL injection flaw (CWE-89) in the relation_type_list parameter of lists_show.php. An unauthenticated attacker can trigger the bug by supplying a dummy UUID in the role_list parameter to bypass authentication and then injecting SQL through relation_type_list. Successful exploitation allows arbitrary SQL queries against the backend database, enabling extraction of sensitive contents such as password hashes and user credentials. All deployments running a version prior to 5.0.12 are affected, with internet-reachable Admidio instances most exposed. Exploitation has not been confirmed: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS places 30-day exploitation probability at only 0.3% (percentile 26), though the 8.7 CVSS 4.0 'high' score reflects the high confidentiality impact.

What to do: Upgrade to Admidio 5.0.12 or later. If an immediate upgrade is not possible, restrict or filter requests to lists_show.php (particularly the relation_type_list parameter) via a WAF or reverse proxy and review web access logs for anomalous relation_type_list values. Because the flaw can expose password hashes and credentials, consider forcing password resets and verifying stored hash strength if compromise is suspected.