CVE-2026-41660: Admidio Privilege Escalation Vulnerability

CVE-2026-41660 Overview

CVE-2026-41660 is an authorization flaw in Admidio, an open-source user management solution. A logic error in the two-factor authentication (2FA) reset routine inverts the authorization check. Non-admin users cannot remove their own Time-based One-Time Password (TOTP) configuration, but they can remove TOTP from other accounts, including administrators. A group leader holding profile edit rights on an administrator account can strip that administrator's 2FA protection. The maintainers patched the issue in Admidio version 5.0.9. The flaw maps to CWE-863: Incorrect Authorization.

Critical Impact
A low-privileged group leader with profile edit rights can remove an administrator's TOTP configuration, weakening account protection and enabling follow-on credential attacks.

Affected Products

Admidio versions prior to 5.0.9
Admidio open-source user management solution
Deployments using TOTP-based two-factor authentication

Discovery Timeline

2026-05-07 - CVE-2026-41660 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-41660

Vulnerability Analysis

The vulnerability resides in Admidio's two-factor authentication reset functionality. The authorization logic that determines whether a user may clear another account's TOTP secret is inverted. Instead of restricting the operation to administrators or the account owner, the check rejects self-resets while permitting cross-account resets by non-admin users.

Any user with profile edit rights on a target account can invoke the 2FA reset and remove that account's TOTP secret. Group leaders frequently hold profile edit rights over members of their groups, which can include administrators. The flaw is a business logic error categorized under CWE-863, Incorrect Authorization.

Root Cause

The root cause is an inverted conditional in the authorization check guarding the TOTP reset path. The function evaluates the requesting user's relationship to the target account and applies the access decision in reverse. This pattern bypasses the principle of least privilege by allowing operations on resources the requester should not control while blocking operations on resources they own.

Attack Vector

Exploitation requires authenticated network access and pre-existing profile edit rights over the target account. An attacker logs into Admidio as a group leader, navigates to the administrator's profile, and triggers the 2FA reset. The administrator's TOTP secret is removed without their consent. The attacker can then attempt password-based attacks against the now single-factor account.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-rh3w-4ccx-prf9 for additional technical context.

Detection Methods for CVE-2026-41660

Indicators of Compromise

Audit log entries showing TOTP reset operations performed by non-administrative accounts against administrator profiles
Unexpected disabling of 2FA on privileged accounts followed by password reset or login activity from new sources
Group leaders accessing administrator profile edit pages outside normal workflows

Detection Strategies

Review Admidio application logs for removeTotp or equivalent 2FA reset events and correlate the actor account against the target account's role
Alert when any account with a non-admin role triggers a 2FA configuration change on an admin-tier account
Baseline normal group leader activity and flag deviations involving profile edits on accounts outside their group scope

Monitoring Recommendations

Forward Admidio web server and application logs to a centralized logging platform for retention and correlation
Monitor authentication telemetry for administrator accounts that lose 2FA enrollment, then re-authenticate from new IP addresses or user agents
Track profile edit permission grants to non-administrative roles and review them periodically

How to Mitigate CVE-2026-41660

Immediate Actions Required

Upgrade Admidio to version 5.0.9 or later, which contains the corrected authorization logic
Audit all accounts for unauthorized TOTP removals and require affected administrators to re-enroll 2FA
Review group leader assignments and remove profile edit rights over administrator accounts where not operationally required
Rotate administrator passwords for any account whose 2FA may have been reset by an unauthorized user

Patch Information

Admidio version 5.0.9 fixes the inverted authorization check. Release notes and the patched build are available at the Admidio v5.0.9 Release. The vendor advisory is published as GHSA-rh3w-4ccx-prf9.

Workarounds

Restrict profile edit rights so that only administrators can modify administrator profiles until the patch is applied
Reduce the number of group leader assignments that overlap with privileged accounts
Require administrators to verify 2FA enrollment status after each login until the upgrade is complete

bash

# Upgrade Admidio to the patched release
cd /var/www/admidio
wget https://github.com/Admidio/admidio/releases/download/v5.0.9/admidio-5.0.9.zip
unzip -o admidio-5.0.9.zip
php adm_program/installation/update.php