CVE-2026-47227
Received Received - Intake

Privilege Escalation in Admidio User Management

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description
Admidio is an open-source user management solution. `modules/categories.php` checks that the supplied `type` parameter (`ANN`, `EVT`, `ROL`, `USF`, …) corresponds to a module the actor administers. The follow-up "is this specific category editable by me" check at lines 56-61 is dead code because it compares `$getType` (a category-type code) against mode names (`edit`/`save`/`delete`); the condition is permanently false, so `$category->isEditable()` is never invoked. Prior to version 5.0.10, the `delete`, `sequence`, and `save` switch cases load the category by the supplied UUID and act on it without re-checking that the category belongs to a module the actor administers. A user holding only one module-administrator right can therefore destroy or reorder empty categories belonging to *other* modules — for example, an announcements administrator can delete role categories, profile-field categories, or weblink categories that they have no right to touch. Version 5.0.10 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-47227
EUVD
EUVD-2026-57204

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
admidio admidio to 5.0.10 (inc)
admidio admidio 5.0.10
admidio admidio to 5.0.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-47227 is a vulnerability in Admidio versions 5.0.9 and earlier. It involves a dead authorization check in the file modules/categories.php. The code incorrectly validates the type parameter against mode names (edit, save, delete) instead of checking if the user has permissions for the specific category. This allows module administrators to delete or reorder categories belonging to other modules they do not administer.

Detection Guidance

Check Admidio version with: grep -r "version" /path/to/admidio/version.php. If version is 5.0.9 or earlier, the system is vulnerable. Review modules/categories.php for improper authorization checks in delete, sequence, and save cases.

Impact Analysis

An attacker with a single module administrator role (e.g., announcements administrator) can delete or reorder categories from unrelated modules (e.g., roles, events, weblinks). This can lead to data loss, structural metadata destruction, and referential inconsistencies in the application.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by allowing unauthorized users to modify or delete categories across different modules. For GDPR, unauthorized data structure changes might affect data integrity or access controls. For HIPAA, improper category manipulation could lead to unauthorized access or disclosure of protected health information if categories control permissions or data visibility.

Mitigation Strategies

Upgrade Admidio to version 5.0.10 or later immediately. If upgrading is not possible, restrict access to the categories.php file and review user permissions to limit module-administrator roles.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47227. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart