admidio up to 5.0.8 POST modules/inventory.php item_delete authorization

Summaryinfo

A vulnerability categorized as problematic has been discovered in admidio up to 5.0.8. This affects the function item_delete of the file modules/inventory.php of the component POST Handler. Such manipulation leads to authorization. This vulnerability is traded as CVE-2026-41658. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in admidio up to 5.0.8. It has been rated as problematic. Affected by this issue is the function item_delete of the file modules/inventory.php of the component POST Handler. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is integrity. CVE summarizes:

Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio inventory module enforces authorization for destructive operations (delete, retire, reinstate) only in the UI layer by conditionally rendering buttons. The backend POST handlers at modules/inventory.php for item_delete, item_retire, item_reinstate, item_picture_upload, item_picture_save, and item_picture_delete perform CSRF validation but never check whether the requesting user is an inventory administrator. Any authenticated user who can access the inventory module can permanently delete any inventory item and all its associated data. This issue has been patched in version 5.0.9.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-41658 since 04/22/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit.

By approaching the search of inurl:modules/inventory.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 5.0.9 eliminates this vulnerability. The upgrade is hosted for download at github.com.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• admidio

Version

• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6
• 5.0.7
• 5.0.8

Website

• Product: https://github.com/Admidio/admidio/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion