User Management Vulnerability in Admidio Open-Source Solution

CVE-2026-41662

What is CVE-2026-41662?

Admidio, an open-source user management solution, has a vulnerability in versions before 5.0.9 where the Role::stopMembership() function can be exploited. This flaw allows any administrator to remove the last remaining administrator from the system, resulting in a loss of administrative access and locking all other users out of the management interface. The issue arises because the safety checks that would typically prevent such an action are bypassed in the current code path. Although redundant checks exist in the deprecated Membership::stopMembership(), they are ineffective in this instance. Sequential removal requests can trigger this vulnerability, making it critical to upgrade to version 5.0.9 or later to safeguard against this issue.

References