CVE-2026-47233

Name of the Vulnerable Software and Affected Versions Admidio versions 5.0.9 through 5.0.9

Description An incomplete fix in the inventory module allows any authenticated user to permanently delete non-system inventory fields. The issue exists because the field delete handler in modules/inventory.php only validates a session-bound CSRF token and fails to verify if the user has administrative privileges via the isAdministratorInventory() check. Additionally, the AdmidioInventoryEntityItemField::delete() function does not enforce administrative rights at the entity level.

An attacker can exploit this by sending a POST request to the modules/inventory.php endpoint with the mode parameter set to field delete and a valid uuid for the target field. This action results in the permanent removal of the field definition, all associated item data in the adm inventory item data table, and all field options in the adm inventory field options table.

Recommendations Update Admidio to version 5.0.10. As a temporary mitigation, restrict access to the modules/inventory.php endpoint for non-administrative users or disable the inventory module if not required.