6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41658

CVE-2026-41658: Admidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items

Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio inventory module enforces authorization for destructive operations (delete, retire, reinstate) only in the UI layer by conditionally rendering buttons. The backend POST handlers at modules/inventory.php for item_delete, item_retire, item_reinstate, item_picture_upload, item_picture_save, and item_picture_delete perform CSRF validation but never check whether the requesting user is an inventory administrator. Any authenticated user who can access the inventory module can permanently delete any inventory item and all its associated data. This issue has been patched in version 5.0.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41658

CVE-2026-41658:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
admidio/admidio	composer	<= 5.0.8	5.0.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because of a missing authorization check in several backend handlers within modules/inventory.php. While the UI correctly hides destructive action buttons from non-administrators, the backend API endpoints are left unprotected. Any authenticated user can craft a POST request to these endpoints to perform destructive actions like deleting, retiring, or reinstating inventory items, as well as managing item pictures. The analysis of the patch for version 5.0.9 confirms that an authorization check using $gCurrentUser->isAdministratorInventory() was added to the item_delete handler, validating the vulnerability report. The vulnerability report also explicitly names other affected handlers (item_retire, item_reinstate, etc.) and service/data layer methods (ItemService.delete, ItemsData.deleteItem) that lack authorization, which are included in the analysis. The root cause is the failure to implement server-side authorization checks, relying only on client-side UI controls for security.

Vulnerable functions

inventory.php

modules/inventory.php

The main script `inventory.php` handles multiple actions based on the 'mode' parameter. The 'item_delete' action was missing an authorization check, allowing any authenticated user to delete inventory items. The patch adds a check for administrator privileges.

inventory.php

modules/inventory.php

The 'item_retire' action within `inventory.php` was missing an authorization check, allowing any authenticated user to retire inventory items.

inventory.php

modules/inventory.php

The 'item_reinstate' action within `inventory.php` was missing an authorization check, allowing any authenticated user to reinstate inventory items.

inventory.php

modules/inventory.php

The 'item_picture_upload' action within `inventory.php` was missing an authorization check, allowing any authenticated user to upload pictures for inventory items.

inventory.php

modules/inventory.php

The 'item_picture_save' action within `inventory.php` was missing an authorization check, allowing any authenticated user to save pictures for inventory items.

inventory.php

modules/inventory.php

The 'item_picture_delete' action within `inventory.php` was missing an authorization check, allowing any authenticated user to delete pictures from inventory items.

ItemService.delete

src/Inventory/Service/ItemService.php

This service method is called by the `item_delete` handler and directly performs the deletion logic without verifying the user's permissions.

ItemsData.deleteItem

src/Inventory/ValueObjects/ItemsData.php

This data access method executes the raw SQL DELETE statement on the database. It is called by `ItemService.delete` and lacks any authorization checks, making it a key component in the data destruction.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.