CVE-2026-47233

Admidio is an open-source user management solution. Version 5.0.9 added a missing "isAdministratorInventory" gate to "case 'itemdelete':" in "modules/inventory.php". The same fix was not applied to the sibling "case 'fielddelete':" handler, which destroys an entire inventory field definition,...

CVE-2026-47233: Missing Authorization

Admidio is an open-source user management solution. Version 5.0.9 added a missing isAdministratorInventory gate to case 'itemdelete': in modules/inventory.php. The same fix was not applied to the sibling case 'fielddelete': handler, which destroys an entire inventory field definition, cascading t...

CVE-2026-41658

Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio inventory module enforces authorization for destructive operations delete, retire, reinstate only in the UI layer by conditionally rendering buttons. The backend POST handlers at modules/inventory.php for...