CVE-2026-47233 in Admidio
Summary
by MITRE • 08/12/2026
Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `case 'item_delete':` in `modules/inventory.php`. The same fix was not applied to the sibling `case 'field_delete':` handler, which destroys an entire inventory field definition, cascading to every `adm_inventory_item_data` row that referenced that field and every `adm_inventory_field_options` entry. The handler validates only a session-bound CSRF token; there is no `isAdministratorInventory()` check at the controller level, and `Admidio\Inventory\Entity\ItemField::delete()` does not enforce one at the entity level either (unlike its sibling `ItemField::save()`, which does check `$gCurrentUser->isAdministrator()`). Any user who can log in to the site can permanently destroy a non-system inventory field by sending one POST. Version 5.0.10 provides an updated fix.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability in Admidio version 5.0.9 represents a critical access control flaw that undermines the integrity of the inventory management system through improper authorization checks. This issue stems from an inconsistent security implementation where the `isAdministratorInventory()` permission gate was correctly applied to one handler case but omitted from its sibling case, creating a dangerous privilege escalation vector. The vulnerability specifically affects the `modules/inventory.php` file where the `case 'item_delete':` block properly validates administrator privileges while the corresponding `case 'field_delete':` block lacks this crucial authorization check, allowing any authenticated user to execute destructive operations.
The technical flaw manifests as a missing authorization validation at both controller and entity levels within the inventory module's delete functionality. The system performs CSRF token validation but fails to enforce proper administrative permissions when processing field deletion requests. This inconsistency is particularly concerning because the `ItemField::delete()` method at the entity level does not validate administrator privileges, unlike its sibling `ItemField::save()` method which correctly enforces `$gCurrentUser->isAdministrator()` checks. The vulnerability operates through a simple POST request that can destroy entire inventory field definitions, triggering cascading deletions that remove all related data from `adm_inventory_item_data` and `adm_inventory_field_options` tables, effectively corrupting the inventory structure.
The operational impact of this vulnerability is severe as it allows any authenticated user to permanently delete non-system inventory fields, which can result in complete data loss and system instability. The cascading nature of the deletion means that when a field is removed, every item referencing that field and all associated field options are simultaneously destroyed, potentially affecting multiple users and disrupting critical inventory operations. This vulnerability directly violates principle of least privilege and represents a classic case of insecure direct object reference where unauthorized users can manipulate system resources through exposed API endpoints. The attack vector requires minimal effort from an attacker since only a valid login session is needed to exploit this weakness.
The fix implemented in version 5.0.10 addresses the root cause by applying the missing `isAdministratorInventory()` check to both handler cases, ensuring consistent authorization enforcement across all inventory management operations. This remediation aligns with security best practices outlined in the CWE database under category 284 for improper access control and follows ATT&CK framework tactics related to privilege escalation through insecure object references. Organizations using Admidio version 5.0.9 should immediately upgrade to 5.0.10 or implement compensating controls such as network segmentation, monitoring of inventory field deletion operations, and regular database backups to mitigate potential exploitation. The vulnerability also highlights the importance of consistent security implementation patterns and the need for thorough code reviews to prevent similar issues in other parts of the application where similar authorization checks may be missing.
This vulnerability demonstrates how incomplete security implementations can create dangerous gaps even when basic protections like CSRF tokens are present. The inconsistency between the two similar handler cases suggests a potential oversight during development or code review processes, emphasizing the need for comprehensive security testing and adherence to established security frameworks. The impact extends beyond immediate data loss to potentially affect system availability and user trust in the application's integrity. Proper implementation of the fix ensures that administrative privileges are consistently enforced at both the controller and entity levels, preventing unauthorized modifications while maintaining legitimate administrative functionality.