CVE-2026-47227 Overview
CVE-2026-47227 is a broken access control vulnerability [CWE-639] in Admidio, an open-source user management solution. The flaw resides in modules/categories.php, where an authorization check intended to confirm category ownership is dead code. As a result, any user holding administrator rights over a single Admidio module can delete or reorder empty categories that belong to other modules they have no authority over. For example, an announcements administrator can destroy role categories, profile-field categories, or weblink categories. Admidio versions prior to 5.0.10 are affected, and version 5.0.10 remediates the issue.
Critical Impact
Authenticated users with limited module-administrator rights can delete or reorder categories belonging to modules they do not administer, causing integrity loss across Admidio configuration data.
Affected Products
- Admidio versions prior to 5.0.10
- modules/categories.phpdelete, sequence, and save switch cases
- Deployments granting scoped module-administrator rights (announcements, events, roles, profile fields, weblinks)
Discovery Timeline
- 2026-08-12 - CVE-2026-47227 published to the National Vulnerability Database (NVD)
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-47227
Vulnerability Analysis
Admidio scopes administrative permissions per module using type codes such as ANN (announcements), EVT (events), ROL (roles), and USF (user-defined profile fields). The modules/categories.php script accepts a type parameter and validates that the acting user administers that module type. This first check functions correctly.
The follow-up per-category authorization check at lines 56-61 is broken. It compares $getType, which holds a category-type code like ANN or ROL, against mode names such as edit, save, and delete. These value sets never overlap, so the condition evaluates to false in every request. Consequently, $category->isEditable() is never invoked, and the intended object-level access check never runs.
Root Cause
The root cause is a logic error in the authorization guard that renders it dead code. Because the guard never fires, the delete, sequence, and save switch cases load the target category by its supplied UUID and act on it without confirming that the category belongs to a module the caller administers. This is a classic Authorization Bypass Through User-Controlled Key pattern, aligned with [CWE-639].
Attack Vector
An authenticated attacker with administrator rights over any single Admidio module submits a request to modules/categories.php with a mode of delete, sequence, or save and a uuid referencing a category owned by a different module. The first-level check passes because the attacker legitimately administers their own module type. The broken second-level check is skipped entirely, and the operation succeeds against the unrelated category. Only empty categories can be destroyed or reordered, but this is sufficient to disrupt role assignments, profile field organization, and other Admidio configuration structures. See the GitHub Security Advisory for the annotated source.
Detection Methods for CVE-2026-47227
Indicators of Compromise
- Unexpected deletion or reordering of category objects (roles, profile fields, weblinks, events) in Admidio audit logs.
- HTTP POST or GET requests to modules/categories.php with mode=delete, mode=sequence, or mode=save where the type parameter does not match the acting user's administered modules.
- Category UUIDs referenced in requests that do not correspond to the actor's normal administrative scope.
Detection Strategies
- Review web server access logs for requests to modules/categories.php and correlate the type and uuid parameters with the authenticated user's permission set.
- Compare current Admidio category inventory against known-good backups to identify missing or reordered entries.
- Enable and monitor Admidio's built-in change history for the adm_categories table.
Monitoring Recommendations
- Alert on any category deletion performed by accounts that are not global administrators.
- Track the volume of sequence and delete operations per user and flag anomalies against a baseline.
- Forward Admidio application logs to a centralized log platform for correlation with authentication events.
How to Mitigate CVE-2026-47227
Immediate Actions Required
- Upgrade Admidio to version 5.0.10 or later without delay.
- Audit existing module-administrator role assignments and revoke any that are no longer required.
- Back up the Admidio database before upgrading so that any tampered categories can be restored.
Patch Information
Admidio version 5.0.10 corrects the flawed authorization logic in modules/categories.php so that the per-category ownership check is enforced for the delete, sequence, and save operations. Full details are available in the GitHub Security Advisory GHSA-rwjr-qjj3-mq2f.
Workarounds
- Restrict module-administrator rights to trusted users until the upgrade is applied.
- Place modules/categories.php behind an additional web application firewall rule that inspects the type parameter against the authenticated session's role scope.
- Monitor the adm_categories table for unauthorized modifications and restore from backup if tampering is detected.
# Configuration example: verify Admidio version after upgrade
grep -R "ADMIDIO_VERSION" /var/www/admidio/adm_program/system/constants.php
# Expected output should reference 5.0.10 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
