CVE-2026-47233 PUBLISHED

Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024

Assigner: GitHub_M
Reserved: 18.05.2026 Published: 12.08.2026 Updated: 12.08.2026

Admidio is an open-source user management solution. Version 5.0.9 added a missing isAdministratorInventory() gate to case 'item_delete': in modules/inventory.php. The same fix was not applied to the sibling case 'field_delete': handler, which destroys an entire inventory field definition, cascading to every adm_inventory_item_data row that referenced that field and every adm_inventory_field_options entry. The handler validates only a session-bound CSRF token; there is no isAdministratorInventory() check at the controller level, and Admidio\Inventory\Entity\ItemField::delete() does not enforce one at the entity level either (unlike its sibling ItemField::save(), which does check $gCurrentUser->isAdministrator()). Any user who can log in to the site can permanently destroy a non-system inventory field by sending one POST. Version 5.0.10 provides an updated fix.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS Score: 6.5

Product Status

Vendor Admidio
Product admidio
Versions
  • Version < 5.0.10 is affected

References

Problem Types

  • CWE-862: Missing Authorization CWE
  • CWE-1281: Sequence of Processor Instructions Leads to Unexpected Behavior CWE