CVE-2026-47233: Admidio Inventory Field Deletion Vulnerability
Summary
CVE-2026-47233: Commit d37ca6b27b9674238e58491cf7ba292e66898f15 ("Delete item not check admin rights #2024", 2026-04-12) added a missing isAdministratorInventory() gate to case 'item_delete': in modules/inventory.php. Affects admidio/admidio versions < 5.0.10. Fixed in 5.0.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Admidio is an open-source project management tool designed for organizations to manage memberships, events, and inventories. It provides a flexible inventory module that allows users to create and manage custom fields for inventory items. However, a security flaw has been identified in the inventory module that permits any logged-in user to delete inventory fields without proper authorization, potentially leading to significant data loss.
Vulnerability Detail
The vulnerability arises from an incomplete fix in the Admidio codebase, specifically in the inventory module's field deletion functionality. The code fails to enforce administrative rights for the 'field_delete' operation, allowing any authenticated user to delete inventory fields. This oversight can lead to the permanent destruction of custom inventory fields, along with all associated data, without any recovery options. The vulnerability is exacerbated by the fact that the deletion operation only checks for a valid CSRF token, neglecting to verify the user's administrative privileges. As a result, a non-administrator user can exploit this flaw to erase critical inventory data, impacting the integrity of the organization's inventory management.
How To Fix
Minimum fixed version
5.0.10
This is the first release that contains the fix.
composer require admidio/admidio:5.0.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the inventory module for non-administrator users until the package is updated. This can be done by modifying user roles and permissions in the Admidio settings to ensure that only users with administrative privileges can access the inventory management features.
Conclusion
CVE-2026-47233 is a significant vulnerability in the Admidio inventory module that allows unauthorized deletion of inventory fields by any logged-in user. It is crucial for organizations using Admidio to update to the patched version to safeguard their data and maintain the integrity of their inventory management system.
See every vulnerability recorded for admidio/admidio →
FAQ
CVE-2026-47233 is a vulnerability in the Admidio inventory module that allows any logged-in user to delete inventory fields without proper authorization.
If you are using Admidio version 5.0.9 or earlier, your installation is vulnerable. You can check your version in the application settings or by reviewing the composer.lock file.
The vulnerability can lead to the permanent deletion of custom inventory fields and all associated data, which can severely impact inventory management and data integrity.
Update your Admidio installation to version 5.0.10 or later to apply the patch that addresses this vulnerability.
Yes, you can use Vulert to monitor your open-source dependencies for vulnerabilities in real-time. Vulert analyzes your composer.lock file to provide alerts for any known issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for admidio/admidio.
