Is CVE-2026-47233 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47233 being exploited in the wild.

How severe is CVE-2026-47233?

Medium severity, with a CVSS score of 6.5, published 29 May 2026.

Which products and versions are affected?

Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.

Is there a fix for CVE-2026-47233?

Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47233 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-47233?

Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47233: Admidio unauthorized inventory field deletion in inventory module

Q: Which products and versions are affected?

Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.

Q: Is there a fix for CVE-2026-47233?

Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47233 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-47233?

Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47233 · Severity: medium · CVSS 6.5 · Published 2026-05-29

Admidio is a free open-source user management system for organizations and groups. A vulnerability in the inventory module allows any logged-in member, regardless of their actual permissions, to permanently delete inventory field definitions and all associated data. This could lead to significant data loss and operational disruption, as custom inventory structures and item details can be wiped by a single malicious user.

Technologies: Admidio, admidio/admidio (Packagist). Vendors: Admidio, Packagist.

Quick answers

Is CVE-2026-47233 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47233 being exploited in the wild.
How severe is CVE-2026-47233?: Medium severity, with a CVSS score of 6.5, published 29 May 2026.
Which products and versions are affected?: Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.
Is there a fix for CVE-2026-47233?: Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47233 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47233?: Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

admidio/admidio (Packagist): upgrade to 5.0.10 or later
```
composer require admidio/admidio:^5.0.10
```

Technical details

The vulnerability exists in `modules/inventory.php` due to an incomplete fix for a previous authorization bypass. While the `item_delete` action was patched with an `isAdministratorInventory()` check, the `field_delete` action (and several sibling handlers like `delete_option_entry` and `item_retire`) only validates a CSRF token. Because the CSRF token is available to any logged-in user, an attacker with low-level 'Member' privileges can send a POST request to delete non-system inventory fields. This action triggers a cascading delete in the database, removing entries from `adm_inventory_item_data` and `adm_inventory_field_options`. The issue is present in versions up to 5.0.9 and is addressed in version 5.0.10.

Affected products

Admidio Admidio <= 5.0.9

Identifiers

CVE-2026-47233
GHSA-xw54-c3mx-9pm3

Timeline

2026-04-12: other: Incomplete fix attempted in commit d37ca6b
2026-05-25: advisory: GHSA-xw54-c3mx-9pm3 published
2026-05-29: disclosed: CVE-2026-47233 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.