CVE-2026-47233 Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024
Any logged-in user can permanently delete inventory fields and associated data due to a missing administrator authorization check in the field deletion handler.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47233?
CVE-2026-47233 is a medium-severity missing authorization vulnerability in admidio, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `case 'item_delete':` in `modules/inventory.php`. The same fix was not applied to the sibling `case 'field_delete':` handler, which destroys an entire inventory field definition, cascading to every `adm_inventory_item_data` row that referenced that field and every `adm_inventory_field_options` entry. The handler validates only a session-bound CSRF token; there is no `isAdministratorInventory()` check at the controller level, and `Admidio\Inventory\Entity\ItemField::delete()` does not enforce one at the entity level either (unlike its sibling `ItemField::save()`, which does check `$gCurrentUser->isAdministrator()`). Any user who can log in to the site can permanently destroy a non-system inventory field by sending one POST. Version 5.0.10 provides an updated fix.
Which versions are affected by CVE-2026-47233?
2 open source packages ship an affected version, including admidio/admidio.
| Package | Affected | Fixed in |
|---|---|---|
admidio/admidio Packagist | All versions | 5.0.10 |
admidio/admidio Packagist | All versions | 5.0.10 |
How do I fix CVE-2026-47233?
Upgrade admidio/admidio to 5.0.10 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-47233 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47233 exists.
Sources
Also known as GHSA-xw54-c3mx-9pm3.