5.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41662

CVE-2026-41662: Admidio: Missing Minimum Administrator Check in Role Membership Removal

Admidio is an open-source user management solution. Prior to version 5.0.9, Role::stopMembership() does not verify whether removing a user from the administrator role leaves zero administrators. The deprecated Membership::stopMembership() contains this safety check, but the current code path bypasses it. Any administrator can remove the last remaining other administrator, locking the entire system out of administrative access. The exploit does not require concurrent requests; sequential removals produce the same result. This issue has been patched in version 5.0.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41662

CVE-2026-41662:

5.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
admidio/admidio	composer	<= 5.0.8	5.0.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description clearly identifies Role::stopMembership() in src/Roles/Entity/Role.php as the source of the vulnerability, due to a missing check for the minimum number of administrators. By comparing the git tags for the vulnerable version (5.0.8) and the patched version (5.0.9), I was able to isolate the specific commit that fixed the issue. The commit 95bd356881044c451d2c963915f8e651497759b5 contains the message 'All members of adminitrator role could be removed #2022' and modifies the Role::stopMembership function. The patch adds a crucial check at the beginning of the function to verify if the role is an administrator role and if removing the user would leave the role empty. If so, it throws an exception, preventing the action. This directly confirms that Role::stopMembership was the vulnerable function, as it lacked this essential validation, allowing for a denial of service by locking out all administrators.

Vulnerable functions

Role::stopMembership

src/Roles/Entity/Role.php

The `Role::stopMembership` function was vulnerable because it allowed the removal of a user from a role without checking if that role was the administrator role and if the removal would leave no administrators. This could be exploited by an administrator to remove the last other administrator, leading to a complete lockout from the system's administrative functions. The patch mitigates this by adding a check to ensure that if the role is an administrator role, there is always at least one member remaining.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.