CVE-2026-47233

🗓️ 12 Aug 2026 13:57:14Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 131 Views🌐 WEB

Admidio 5.0.9 lets any logged-in user delete inventory fields; fixed in 5.0.10.

Reporter	Title	Published	Views	Family All 11
attackerkb	CVE-2026-47233	12 Aug 202613:57	–	attackerkb
Circl	CVE-2026-47233	25 May 202608:45	–	circl
Cvelist	CVE-2026-47233 Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024	12 Aug 202613:57	–	cvelist
EUVD	EUVD-2026-57214	12 Aug 202613:57	–	euvd
Github Security Blog	Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024	29 May 202622:09	–	github
NVD	CVE-2026-47233	12 Aug 202615:17	–	nvd
OSV	GHSA-XW54-C3MX-9PM3 Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024	29 May 202622:09	–	osv
Positive Technologies	PT-2026-45043	29 May 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-47233: Missing Authorization	12 Aug 202600:00	–	rapid7
Snyk	Sequence of Processor Instructions Leads to Unexpected Behavior	29 May 202622:09	–	snyk

Vulners

Node

admidio admidioRange<5.0.10

[
  {
    "vendor": "Admidio",
    "product": "admidio",
    "versions": [
      {
        "version": "< 5.0.10",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/Admidio/admidio/commit/d37ca6b27b9674238e58491cf7ba292e66898f15
github	www.github.com/Admidio/admidio/security/advisories/GHSA-xw54-c3mx-9pm3

Parameter	Position	Path	Description	CWE
action	request body	modules/inventory.php	Missing isAdministratorInventory() check for inventory deletion (item_delete and field_delete) allows any logged-in user to destroy inventory data via POST since only CSRF validation is performed.	CWE-1281, CWE-862

09 Sep 2026 20:55Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.16.5

EPSS0.00311

SSVC