Lucene search
+L

1 matches found

OSV
OSV
added 2026/05/29 10:9 p.m.16 views

GHSA-XW54-C3MX-9PM3 Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024

Summary Commit d37ca6b27b9674238e58491cf7ba292e66898f15 "Delete item not check admin rights 2024", 2026-04-12 added a missing isAdministratorInventory gate to case 'itemdelete': in modules/inventory.php. The same fix was not applied to the sibling case 'fielddelete': handler, which destroys an...

6.5CVSS5.8AI score0.00221EPSS
SaveExploits0References2
Rows per page
Query Builder