CVE-2026-47227 Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`
A module administrator can delete or reorder categories belonging to other modules due to a dead authorization check in Admidio.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47227?
CVE-2026-47227 is a medium-severity missing authorization vulnerability in admidio, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Admidio is an open-source user management solution. `modules/categories.php` checks that the supplied `type` parameter (`ANN`, `EVT`, `ROL`, `USF`, …) corresponds to a module the actor administers. The follow-up "is this specific category editable by me" check at lines 56-61 is dead code because it compares `$getType` (a category-type code) against mode names (`edit`/`save`/`delete`); the condition is permanently false, so `$category->isEditable()` is never invoked. Prior to version 5.0.10, the `delete`, `sequence`, and `save` switch cases load the category by the supplied UUID and act on it without re-checking that the category belongs to a module the actor administers. A user holding only one module-administrator right can therefore destroy or reorder empty categories belonging to *other* modules — for example, an announcements administrator can delete role categories, profile-field categories, or weblink categories that they have no right to touch. Version 5.0.10 fixes the issue.
Which versions are affected by CVE-2026-47227?
2 open source packages ship an affected version, including admidio/admidio.
| Package | Affected | Fixed in |
|---|---|---|
admidio/admidio Packagist | All versions | 5.0.10 |
admidio/admidio Packagist | All versions | 5.0.10 |
How do I fix CVE-2026-47227?
Upgrade admidio/admidio to 5.0.10 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-47227 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47227 exists.
Sources
Also known as GHSA-rwjr-qjj3-mq2f.