Executive brief
Admidio is a free open-source user management system for organizations and groups. A vulnerability in the inventory module allows any logged-in member, regardless of their actual permissions, to permanently delete inventory field definitions and all associated data. This could lead to significant data loss and operational disruption, as custom inventory structures and item details can be wiped by a single malicious user.
Technical details
The vulnerability exists in `modules/inventory.php` due to an incomplete fix for a previous authorization bypass. While the `item_delete` action was patched with an `isAdministratorInventory()` check, the `field_delete` action (and several sibling handlers like `delete_option_entry` and `item_retire`) only validates a CSRF token. Because the CSRF token is available to any logged-in user, an attacker with low-level 'Member' privileges can send a POST request to delete non-system inventory fields. This action triggers a cascading delete in the database, removing entries from `adm_inventory_item_data` and `adm_inventory_field_options`. The issue is present in versions up to 5.0.9 and is addressed in version 5.0.10.
Affected products
- Admidio Admidio <= 5.0.9
Timeline
- 2026-04-12: other: Incomplete fix attempted in commit d37ca6b
- 2026-05-25: advisory: GHSA-xw54-c3mx-9pm3 published
- 2026-05-29: disclosed: CVE-2026-47233 assigned