CVE-2026-47233: Admidio Auth Bypass Vulnerability

CVE-2026-47233 Overview

CVE-2026-47233 is a missing authorization vulnerability [CWE-862] in Admidio, an open-source user management application. The flaw resides in the case 'field_delete': handler within modules/inventory.php. Version 5.0.9 introduced an isAdministratorInventory() check to the sibling case 'item_delete': handler but omitted the same gate on field_delete. Any authenticated user can send a single POST request with a valid session-bound CSRF token to permanently destroy a non-system inventory field. The deletion cascades to every adm_inventory_item_data row and adm_inventory_field_options entry linked to that field. Admidio 5.0.10 ships the corrected authorization check.

Critical Impact
Any authenticated Admidio user can permanently destroy inventory field definitions and cascade-delete associated inventory data through a single POST request.

Affected Products

Admidio versions prior to 5.0.10
Admidio 5.0.9 (partial fix applied only to item_delete handler)
Admidio installations exposing the inventory module to non-admin users

Discovery Timeline

2026-08-12 - CVE-2026-47233 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-47233

Vulnerability Analysis

The defect is an authorization gap in the inventory controller. In modules/inventory.php, the field_delete action validates only the CSRF token before invoking Admidio\Inventory\Entity\ItemField::delete(). No call to $gCurrentUser->isAdministratorInventory() guards the operation. The entity layer does not compensate for the missing controller check. Unlike its sibling ItemField::save(), which enforces $gCurrentUser->isAdministrator(), the delete() method performs no privilege verification. When the handler executes, database cascades remove every row in adm_inventory_item_data referencing the deleted field and every option entry in adm_inventory_field_options. The result is permanent loss of both the field schema and all associated inventory data.

Root Cause

The root cause is inconsistent enforcement of the isAdministratorInventory() check across sibling handlers. Version 5.0.9 patched item_delete but did not audit the neighboring field_delete case. The ItemField entity itself lacks defense-in-depth authorization on delete(), so the missing controller check exposes the full destructive capability to any authenticated session.

Attack Vector

Exploitation requires only a valid authenticated session on the target Admidio instance. The attacker retrieves a CSRF token from any authenticated page, then submits a crafted POST request to the inventory controller with mode=field_delete and the UUID of the target field. No administrative role, no user interaction, and no additional privileges are needed. The request executes the delete path and destroys the field along with its dependent rows.

php

            // check the CSRF token of the form against the session token
            SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']);

+            // check if user has admin rights for inventory
+            if (!$gCurrentUser->isAdministratorInventory()) {
+                throw new Exception('SYS_NO_RIGHTS');
+            }
+
            if (count($getItemUUIDs) > 0) {
                foreach ($getItemUUIDs as $itemUuid) {
                    $itemService = new ItemService($gDb, $itemUuid);

Source: Admidio commit d37ca6b. This patch shows the authorization gate added to the item_delete handler in 5.0.9; the equivalent gate for field_delete is delivered in 5.0.10.

Detection Methods for CVE-2026-47233

Indicators of Compromise

POST requests to modules/inventory.php containing mode=field_delete originating from non-administrator user sessions.
Unexpected disappearance of inventory field definitions from the Admidio administrative interface.
Bulk removal of rows from adm_inventory_item_data or adm_inventory_field_options outside of scheduled administrative activity.

Detection Strategies

Enable verbose access logging on the Admidio web server and alert on field_delete mode parameters submitted by accounts lacking the inventory administrator role.
Correlate application-level audit trails with database change logs to identify destructive field operations executed by unprivileged users.
Deploy a web application firewall rule that inspects POST bodies to inventory.php and flags field_delete requests for review.

Monitoring Recommendations

Monitor database row counts on adm_inventory_item_data and adm_inventory_field_options for sudden drops.
Capture and retain HTTP request bodies for the inventory controller to enable forensic reconstruction of any abusive delete calls.
Review authentication logs alongside inventory change events to attribute deletions to specific user accounts.

How to Mitigate CVE-2026-47233

Immediate Actions Required

Upgrade every Admidio deployment to version 5.0.10 or later, which adds the missing isAdministratorInventory() check to the field_delete handler.
Audit inventory field definitions and associated data for any deletions that occurred prior to patching.
Restrict network access to the Admidio administration surface where feasible until the update is applied.

Patch Information

Admidio 5.0.10 provides the corrected authorization gate. Review the Admidio Security Advisory GHSA-xw54-c3mx-9pm3 and the remediation commit for full technical detail. Restore any lost inventory fields and rows from backups taken before exploitation.

Workarounds

If immediate upgrade is not possible, restrict the inventory module to trusted user roles at the web server or reverse proxy layer.
Manually add an isAdministratorInventory() check to the case 'field_delete': branch in modules/inventory.php, mirroring the 5.0.9 patch applied to item_delete.
Take a verified backup of the Admidio database before applying any interim source-level modifications.

bash

# Verify installed Admidio version and update to the fixed release
grep -R "ADMIDIO_VERSION" /var/www/admidio/adm_program/system/
# Fetch the fixed release
curl -LO https://github.com/Admidio/admidio/archive/refs/tags/v5.0.10.tar.gz
# Back up the database before deploying the update
mysqldump -u admidio_user -p admidio_db > admidio_backup_pre_5010.sql