7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41660

CVE-2026-41660: Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTP

Admidio is an open-source user management solution. Prior to version 5.0.9, a logic error in Admidio's two-factor authentication reset inverts the authorization check. Non-admin users cannot remove their own TOTP configuration, but they can remove other users' TOTP, including administrators. A group leader with profile edit rights on an admin account can strip that admin's 2FA. This issue has been patched in version 5.0.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41660

CVE-2026-41660:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
admidio/admidio	composer	<= 5.0.8	5.0.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a direct result of an incorrect logical operator in an authorization check within the modules/profile/two_factor_authentication.php script. The provided vulnerability description explicitly points out the flawed line of code. By analyzing the patch that fixed the issue in version 5.0.9, I confirmed the exact code change. The commit d51c1c41c867e027f5bed69e5232ac12cafd9c6d modifies the conditional from !== to ===, correcting the logic. The vulnerability is triggered when a POST request with mode=reset is sent to this PHP script. Since the code is procedural and not encapsulated within a specific named function in the file, the entire script two_factor_authentication.php is the vulnerable component that would appear in a runtime profile during exploitation.

Vulnerable functions

two_factor_authentication.php

modules/profile/two_factor_authentication.php

The script `two_factor_authentication.php` contains a logic flaw in its authorization check when handling a 'reset' request for Two-Factor Authentication (2FA). The condition `!($gCurrentUser->isAdministrator() || $gCurrentUserId !== $userId)` incorrectly allows a non-administrator user to reset the 2FA settings of any other user, including administrators. The check should have been `!($gCurrentUser->isAdministrator() || $gCurrentUserId === $userId)`, which would correctly restrict users to only resetting their own 2FA unless they are an administrator.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.