Description

Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `case 'item_delete':` in `modules/inventory.php`. The same fix was not applied to the sibling `case 'field_delete':` handler, which destroys an entire inventory field definition, cascading to every `adm_inventory_item_data` row that referenced that field and every `adm_inventory_field_options` entry. The handler validates only a session-bound CSRF token; there is no `isAdministratorInventory()` check at the controller level, and `Admidio\Inventory\Entity\ItemField::delete()` does not enforce one at the entity level either (unlike its sibling `ItemField::save()`, which does check `$gCurrentUser->isAdministrator()`). Any user who can log in to the site can permanently destroy a non-system inventory field by sending one POST. Version 5.0.10 provides an updated fix.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-12T15:17:33.813Z",
  "pubdate": "2026-08-12T15:17:33.813Z",
  "executiveSummary": "An authorization bypass vulnerability exists in Admidio version 5.0.9 within the inventory management module.\nThe vulnerability allows authenticated low-privileged users to permanently delete non-system inventory field definitions, cascading into the destruction of all associated inventory item data and field options.\nThe root cause stems from a missing access control check in the field deletion handler, contrasting with the proper administrative check implemented for item deletion in the same module.\nExploitation requires a valid user session to bypass session-bound CSRF token validation and the capability to issue a single crafted HTTP POST request.\nThe impact is severe due to the irreversible loss of application data and structural schema tampering.\nAdmidio version 5.0.10 addresses this security flaw by introducing the required administrative gate.",
  "technicalDetails": "The vulnerability resides in the inventory management controller located at modules/inventory.php, specifically within the unmitigated case 'field_delete': handler.\nWhile version 5.0.9 introduced a missing isAdministratorInventory() access control gate to the sibling case 'item_delete': handler, the exact same administrative verification was omitted from the field deletion logic.\nAt the entity layer, Admidio\\Inventory\\Entity\\ItemField::delete() fails to enforce administrative privileges, contrasting with the sibling ItemField::save() method which explicitly validates $gCurrentUser->isAdministrator().\nThe only security validation enforced by the vulnerable 'field_delete': handler is a session-bound CSRF token check, which is easily bypassed by any authenticated user who maintains a valid session on the target Admidio instance.\nStep-by-step attack flow involves an authenticated low-privileged user constructing or intercepting an HTTP POST request targeting modules/inventory.php with the action parameter set to trigger the 'field_delete' case along with a valid CSRF token.\nUpon receiving the request, the controller processes the deletion of the specified non-system inventory field definition without verifying if the requesting user possesses administrative privileges.\nThe database execution cascades, permanently destroying every corresponding row in the adm_inventory_item_data table and every entry in the adm_inventory_field_options table referencing the deleted field.\nAffected versions include Admidio version 5.0.9, while version 5.0.10 provides the updated patch implementing the missing authorization checks."
}