# CVE-2026-47227: Admidio broken authorization in category management

Source: https://junglewise.ai/threats/cve-2026-47227-admidio-broken-authorization-in-category-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-47227 · Severity: medium · CVSS 6.5 · Published 2026-05-29

Admidio is a web-based membership management system. A security flaw allows users with limited administrative rights (such as a forum or announcement moderator) to delete or modify categories belonging to other parts of the system they should not have access to. This could result in the loss of organizational structure, such as the deletion of event calendars, role groupings, or profile field categories, requiring manual restoration from backups.

Technologies: [Admidio](https://junglewise.ai/threats/technologies/admidio), [admidio/admidio (Packagist)](https://junglewise.ai/threats/technologies/admidio-admidio). Vendors: [Admidio](https://junglewise.ai/threats/vendors/admidio), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-47227 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47227 being exploited in the wild.

**How severe is CVE-2026-47227?** Medium severity, with a CVSS score of 6.5, published 29 May 2026.

**Which products and versions are affected?** Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.

**Is there a fix for CVE-2026-47227?** Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47227 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-47227?** Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- admidio/admidio (Packagist): upgrade to 5.0.10 or later

  ```sh
  composer require admidio/admidio:^5.0.10
  ```


## Technical details

A vulnerability exists in `modules/categories.php` due to a 'dead code' authorization check. The script validates that a user has rights for a specific module type (e.g., 'ANN' for announcements) but fails to verify if the specific category being modified (identified by UUID) actually belongs to that module. A logic error in an `in_array` check compares the category type against action modes ('edit', 'save', 'delete'), which always evaluates to false, bypassing the `$category->isEditable()` check. An attacker with any single module-admin privilege can perform POST requests to delete or modify categories of any other type. This is fixed in version 5.0.10.

## Affected products

- Admidio Admidio <= 5.0.9

## Identifiers

- CVE-2026-47227
- GHSA-rwjr-qjj3-mq2f

## Timeline

- 2026-05-25: disclosed
- 2026-05-29: advisory

## References

- [https://api.github.com/users/offset](https://api.github.com/users/offset)
- [https://github.com/offset](https://github.com/offset)
- [https://api.github.com/users/offset/gists%7B/gist_id%7D](https://api.github.com/users/offset/gists%7B/gist_id%7D)
- [https://api.github.com/users/offset/repos](https://api.github.com/users/offset/repos)
- [https://avatars.githubusercontent.com/u/114768995?v=4](https://avatars.githubusercontent.com/u/114768995?v=4)
- [https://api.github.com/users/offset/events%7B/privacy%7D](https://api.github.com/users/offset/events%7B/privacy%7D)

## Related threats

- [Admidio improper access control in event registration](https://junglewise.ai/threats/cve-2026-117554-admidio-before-5-0-17-contains-an-improper-access-control)
- [Admidio information disclosure in RSS weblinks feed](https://junglewise.ai/threats/cve-2026-111916-admidio-before-5-0-16-contains-an-information-disclosure)
- [Admidio broken access control in inventory module](https://junglewise.ai/threats/cve-2026-111914-admidio-from-5-0-11-before-5-0-16-contains-a-broken-access)
- [Admidio authorization bypass via pdfl export mode](https://junglewise.ai/threats/cve-2026-111913-admidio-from-5-0-0-before-5-0-16-contains-an-authorization)
- [Admidio forum topic authorization bypass in ForumService::saveTopic()](https://junglewise.ai/threats/cve-2026-111912-admidio-from-5-0-0-before-5-0-16-contains-an-insecure-direct)