# CVE-2026-47233: Admidio unauthorized inventory field deletion in inventory module

Source: https://junglewise.ai/threats/cve-2026-47233-admidio-unauthorized-inventory-field-deletion-in-inventory-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-47233 · Severity: medium · CVSS 6.5 · Published 2026-05-29

Admidio is a free open-source user management system for organizations and groups. A vulnerability in the inventory module allows any logged-in member, regardless of their actual permissions, to permanently delete inventory field definitions and all associated data. This could lead to significant data loss and operational disruption, as custom inventory structures and item details can be wiped by a single malicious user.

Technologies: [Admidio](https://junglewise.ai/threats/technologies/admidio), [admidio/admidio (Packagist)](https://junglewise.ai/threats/technologies/admidio-admidio). Vendors: [Admidio](https://junglewise.ai/threats/vendors/admidio), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-47233 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47233 being exploited in the wild.

**How severe is CVE-2026-47233?** Medium severity, with a CVSS score of 6.5, published 29 May 2026.

**Which products and versions are affected?** Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.

**Is there a fix for CVE-2026-47233?** Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47233 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47233?** Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- admidio/admidio (Packagist): upgrade to 5.0.10 or later

  ```sh
  composer require admidio/admidio:^5.0.10
  ```


## Technical details

The vulnerability exists in `modules/inventory.php` due to an incomplete fix for a previous authorization bypass. While the `item_delete` action was patched with an `isAdministratorInventory()` check, the `field_delete` action (and several sibling handlers like `delete_option_entry` and `item_retire`) only validates a CSRF token. Because the CSRF token is available to any logged-in user, an attacker with low-level 'Member' privileges can send a POST request to delete non-system inventory fields. This action triggers a cascading delete in the database, removing entries from `adm_inventory_item_data` and `adm_inventory_field_options`. The issue is present in versions up to 5.0.9 and is addressed in version 5.0.10.

## Affected products

- Admidio Admidio <= 5.0.9

## Identifiers

- CVE-2026-47233
- GHSA-xw54-c3mx-9pm3

## Timeline

- 2026-04-12: other: Incomplete fix attempted in commit d37ca6b
- 2026-05-25: advisory: GHSA-xw54-c3mx-9pm3 published
- 2026-05-29: disclosed: CVE-2026-47233 assigned

## References

- [https://api.github.com/users/offset](https://api.github.com/users/offset)
- [https://github.com/offset](https://github.com/offset)
- [https://api.github.com/users/offset/gists%7B/gist_id%7D](https://api.github.com/users/offset/gists%7B/gist_id%7D)
- [https://api.github.com/users/offset/repos](https://api.github.com/users/offset/repos)
- [https://avatars.githubusercontent.com/u/114768995?v=4](https://avatars.githubusercontent.com/u/114768995?v=4)
- [https://api.github.com/users/offset/events%7B/privacy%7D](https://api.github.com/users/offset/events%7B/privacy%7D)

## Related threats

- [Admidio improper access control in event registration](https://junglewise.ai/threats/cve-2026-117554-admidio-before-5-0-17-contains-an-improper-access-control)
- [Admidio information disclosure in RSS weblinks feed](https://junglewise.ai/threats/cve-2026-111916-admidio-before-5-0-16-contains-an-information-disclosure)
- [Admidio broken access control in inventory module](https://junglewise.ai/threats/cve-2026-111914-admidio-from-5-0-11-before-5-0-16-contains-a-broken-access)
- [Admidio authorization bypass via pdfl export mode](https://junglewise.ai/threats/cve-2026-111913-admidio-from-5-0-0-before-5-0-16-contains-an-authorization)
- [Admidio forum topic authorization bypass in ForumService::saveTopic()](https://junglewise.ai/threats/cve-2026-111912-admidio-from-5-0-0-before-5-0-16-contains-an-insecure-direct)