User Management Vulnerability in Admidio Open-Source Solution
CVE-2026-47233

6.5MEDIUM

Key Information:

Vendor

Admidio

Status
Admidio
Vendor
CVE Published:
12 August 2026

What is CVE-2026-47233?

Admidio, an open-source user management solution, contains a vulnerability that enables any authenticated user to delete non-system inventory fields through a single POST request. This flaw arises from a missing administrative check in the 'field_delete' handler in the inventory module. Unlike the 'item_delete' case, which enforces administrator permissions, the handler only relies on session-based CSRF token validation, allowing potentially harmful actions by unauthorized users. Users of Admidio version 5.0.9 and earlier are advised to upgrade to version 5.0.10, which includes a fix addressing this oversight.

Affected Version(s)

admidio < 5.0.10

References

https://github.com/Admidio/admidio/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/Admidio/admidio/commit/d37ca6b27b96742...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.