CVE-2026-47227

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.10

Description An issue exists in modules/categories.php where a logic error in the permission check allows a user with limited administrative rights to manipulate categories belonging to modules they do not administer. The software fails to properly validate if the specific category being modified belongs to a module the actor has rights over because a critical check is rendered dead code by comparing a category-type code against mode names. Consequently, the delete, sequence, and save switch cases process requests based on a supplied UUID without re-verifying the category's ownership.

An attacker with at least one module-administrator right can destroy or reorder empty categories of other modules, such as role categories, event calendars, profile-field categories, weblink categories, forum categories, or inventory categories. This is achieved by sending a request to the modules/categories.php endpoint using a type parameter for which they have rights, while providing the uuid of a category belonging to a different module.

API Endpoints: modules/categories.php Vulnerable Parameters: type, uuid, mode

Recommendations Update Admidio to version 5.0.10. As a temporary workaround, restrict access to the modules/categories.php endpoint to only highly trusted administrators until the update is applied.