GHSA-C7XM-R6VJ-8VG6 Admidio Missing Minimum Administrator Check in Role Membership Removal

Summary Role::stopMembership does not verify whether removing a user from the administrator role leaves zero administrators. The deprecated Membership::stopMembership contains this safety check, but the current code path bypasses it. Any administrator can remove the last remaining other...

PT-2026-37146

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.9 Description An issue exists where the Role::stopMembership function fails to verify if removing a user from the administrator role leaves the system with zero administrators. While the deprecated...