CVE-2026-41662: 
PHP vulnerability analysis and mitigation

CVE-2026-41662 is a missing minimum administrator check vulnerability in Admidio, an open-source user management solution, affecting all versions up to and including 5.0.8. The flaw exists in Role::stopMembership(), which fails to verify that removing a user from the administrator role would leave at least one administrator remaining, enabling a complete administrative lockout. It was published to the GitHub Advisory Database on April 29, 2026, and to the NVD on May 7, 2026. The vulnerability carries a CVSS v3.1 base score of 5.2 (Moderate) (Github Advisory, Admidio Advisory).

The root cause is classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions). The Role::stopMembership() method in src/Roles/Entity/Role.php directly updates a membership end date without querying whether the administrator role would be left with zero active members. The deprecated Membership::stopMembership() previously contained this safety check and raised SYS_MUST_HAVE_ADMINISTRATOR when the removal would leave no admins, but the current code path no longer calls this method. While Role::setMembership() includes a guard preventing self-removal from the admin role, this guard does not prevent an administrator from removing the last other administrator, making sequential requests from two colluding or compromised admin accounts sufficient to trigger the lockout (Admidio Advisory).

Successful exploitation results in a complete denial of administrative access to the Admidio installation, as no users remain in the administrator role. There is no confidentiality impact, but integrity is slightly affected (Low) and availability is severely impacted (High) since the administrative interface becomes entirely inaccessible. Recovery requires direct database manipulation to reassign the administrator role, which may not be feasible in shared hosting environments where direct database access is restricted (Github Advisory, Admidio Advisory).

A proof-of-concept is publicly available in the GitHub Security Advisory, demonstrating exploitation via sequential HTTP POST requests requiring no race condition or concurrent timing. Exploitation requires two active administrator accounts with valid sessions (either colluding insiders or two compromised accounts). The EPSS score is approximately 0.012% (2nd percentile), indicating low probability of near-term automated exploitation. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory).

1. Obtain two administrator sessions: Acquire valid authenticated sessions for two separate administrator accounts (Admin A and Admin B) on the target Admidio instance, either through credential compromise, phishing, or insider access.
2. Identify target UUIDs: Retrieve the user_uuid values for both administrator accounts and the role_uuid for the administrator role from the Admidio interface or API.
3. Admin A removes Admin B: Using Admin A's session, send a POST request to /modules/profile/profile_function.php with parameters mode=stop_membership, user_uuid=<ADMIN_B_UUID>, and role_uuid=<ADMIN_ROLE_UUID>. The server responds with HTTP 200 and removes Admin B from the administrator role.
4. Admin B removes Admin A: Using Admin B's still-valid session (session remains active even after role removal), send an identical POST request targeting Admin A's UUID. The server again responds with HTTP 200.
5. Administrative lockout achieved: The system now has zero administrators. No user can access the administrative interface. Recovery requires direct SQL database access to reassign the administrator role to a user account (Admidio Advisory).

• Network: HTTP POST requests to /modules/profile/profile_function.php with mode=stop_membership and role_uuid matching the administrator role UUID, originating from two different authenticated sessions in close succession.
• Logs: Web server access logs showing two sequential POST requests to the profile function endpoint with stop_membership mode, each from a different authenticated administrator session, resulting in HTTP 200 responses.
• Application Behavior: Complete inability to log in to the Admidio administrative interface; all administrator-level actions return permission errors or redirect to non-admin views, indicating zero active administrator role members.
• Database: Query on the membership table (e.g., adm_members) showing no active records linking any user to the administrator role (rol_id corresponding to the admin role with mem_end set to a past date for all entries) (Admidio Advisory).

Admidio has patched this vulnerability in version 5.0.9, released April 18, 2026. The fix adds a minimum-administrator-count check to Role::stopMembership() that rejects any removal request that would leave the administrator role with zero members, mirroring the check in the deprecated Membership::stopMembership(). All users running Admidio 5.0.8 or earlier should upgrade to 5.0.9 immediately; no configuration-based workaround is available for unpatched versions (Admidio Release, Github Advisory).

The vulnerability was discovered by aisafe.io and reported by the aisafe-bot finder, with adrgs credited as reporter. The Admidio maintainer (Fasse) published the advisory and strongly recommended updating to version 5.0.9. No significant broader media coverage or notable community commentary beyond the GitHub advisory has been identified (Admidio Advisory).