Summary

Authenticated low-privilege users can read another user's future role memberships through profile_function.php, bypassing the profile-level authorization check.

Details

This issue is configuration-dependent. It becomes exploitable when the target role is visible to the attacker (for example, rol_view_memberships = Role members / Logged in users, or the attacker is a leader) and the victim has a future membership (mem_begin > DATE_NOW).

profile.php correctly enforces profile-level authorization via hasRightViewProfile(), but profile_function.php?mode=reload_future_memberships bypasses that check and directly returns the future-membership fragment. The endpoint calls getFutureRolesFromDatabase() and getRoleMemberships(), which only check role-view rights / self-access, not profile authorization or a time-window access check.

Relevant code paths:

• modules/profile/profile.php: profile access check
• modules/profile/profile_function.php: reload_future_memberships
• modules/profile/roles_functions.php: getFutureRolesFromDatabase() / getRoleMemberships()
• src/Users/Entity/User.php: hasRightViewProfile()

PoC

1.Login as USER1.
2.Open profile.php?user_uuid=<victim_uuid> -> access denied.
example url: http://127.0.0.1/admidio_v5.0.9/modules/profile/profile.php?user_uuid=d1da0df1-7c6d-4c54-97fd-de62611ccd93

3.Open profile_function.php?mode=reload_future_memberships&user_uuid=<victim_uuid> -> future membership is returned.
example url: http://127.0.0.1/admidio_v5.0.9/modules/profile/profile_function.php?mode=reload_future_memberships&user_uuid=d1da0df1-7c6d-4c54-97fd-de62611ccd93

Impact

Disclosure of sensitive future memberships to authenticated low-privilege users.