CVE-2026-47233
Received Received - Intake

Unauthorized Field Deletion in Admidio

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description
Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `case 'item_delete':` in `modules/inventory.php`. The same fix was not applied to the sibling `case 'field_delete':` handler, which destroys an entire inventory field definition, cascading to every `adm_inventory_item_data` row that referenced that field and every `adm_inventory_field_options` entry. The handler validates only a session-bound CSRF token; there is no `isAdministratorInventory()` check at the controller level, and `Admidio\Inventory\Entity\ItemField::delete()` does not enforce one at the entity level either (unlike its sibling `ItemField::save()`, which does check `$gCurrentUser->isAdministrator()`). Any user who can log in to the site can permanently destroy a non-system inventory field by sending one POST. Version 5.0.10 provides an updated fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-47233
EUVD
EUVD-2026-57214

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
admidio admidio 5.0.9
admidio admidio to 5.0.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-1281 Specific combinations of processor instructions lead to undesirable behavior such as locking the processor until a hard reset performed.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Admidio allows any logged-in user to permanently delete inventory fields and their associated data without proper administrator rights. The issue occurs because the field deletion handler lacks an isAdministratorInventory() check, unlike the item deletion handler which was fixed earlier. This can destroy custom inventory fields and all related data across the system.

Detection Guidance

Check Admidio logs for unauthorized POST requests to modules/inventory.php with mode=field_delete. Look for CSRF token validation failures or attempts to delete inventory fields by non-admin users.

Impact Analysis

If you use Admidio versions 5.0.9 or earlier, an attacker with login access could delete inventory fields and all their data, including adm_inventory_item_data and adm_inventory_field_options entries. This results in permanent data loss for custom inventory fields and their associated records.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized data deletion. GDPR requires data integrity and protection against unauthorized destruction, while HIPAA mandates access controls to prevent unauthorized modifications. Unauthorized field deletions could violate these requirements.

Mitigation Strategies

Upgrade Admidio to version 5.0.10 or later to apply the missing administrator rights check. Temporarily restrict write access to modules/inventory.php if immediate upgrade is not possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47233. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart