CVE-2026-47233: 
PHP vulnerability analysis and mitigation

CVE-2026-47233 is a missing authorization vulnerability in Admidio's inventory module that allows any authenticated user to permanently delete custom inventory field definitions via the mode=field_delete handler in modules/inventory.php. It affects Admidio versions up to and including 5.0.9 (Composer package admidio/admidio), with version 5.0.10 containing the fix. The vulnerability was published on May 25, 2026, and added to the GitHub Advisory Database on May 29, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Admidio Advisory).

The root cause is CWE-862 (Missing Authorization): a prior fix (commit d37ca6b, 2026-04-12) added an isAdministratorInventory() gate to the case 'item_delete': handler but left the sibling case 'field_delete': handler unprotected. Under the default configuration (inventory_module_enabled=2), the top-level access gate only requires $gValidLogin, meaning any logged-in user reaches the mode dispatch switch. The field_delete handler validates only a session-bound CSRF token — which is freely available to any authenticated user from the ?mode=field_list response — and then calls ItemFieldService::delete() → ItemField::delete(), which performs no administrator check (unlike ItemField::save(), which does enforce $gCurrentUser->isAdministrator()). A single authenticated POST to modules/inventory.php?mode=field_delete&uuid=<field-uuid> with a valid CSRF token is sufficient to trigger cascading DELETE statements against adm_inventory_item_data, adm_inventory_field_options, and adm_inventory_fields (GitHub Advisory, Admidio Advisory).

A low-privileged authenticated user (standard Member role) can permanently destroy any non-system custom inventory field, wiping all per-item data values stored against that field (adm_inventory_item_data), all dropdown/radio/multiselect option entries (adm_inventory_field_options), and the field definition itself (adm_inventory_fields). There is no in-product undo mechanism; recovery requires restoring from a database backup. An attacker with a single rogue member account can enumerate all non-system fields via field_list and delete them all in a few requests, rendering the entire inventory module's user-defined schema unrecoverable. Confidentiality is not impacted (no data is exposed), but integrity and effective availability of the inventory module are severely affected (GitHub Advisory).

A working proof-of-concept was tested and confirmed on Admidio HEAD commit c5cde53 with PHP 8.4 and MariaDB 11.8 under the default installation configuration, and is publicly documented in the GitHub advisory. The vulnerability requires only a valid authenticated session (any Member-role account) and the session CSRF token, which is trivially obtained from the field_list page response. No exploit kits or threat actor attribution have been reported, and the CVE status remains Reserved. No EPSS score or CISA KEV listing is currently available (GitHub Advisory, Admidio Advisory).

1. Obtain a low-privileged account: Register or obtain credentials for any standard Member-role account on the target Admidio instance (no special permissions required).
2. Login and capture the initial CSRF token: Send a GET request to the Admidio root, extract the adm_csrf_token from the HTML response, then POST credentials to system/login.php?mode=check to authenticate and establish a session cookie.
3. Retrieve the session CSRF token from the inventory field list: Send a GET request to modules/inventory.php?mode=field_list using the authenticated session cookie. Extract the adm_csrf_token value from the JSON callback in the response — this is the token required for state-changing POSTs.
4. Enumerate non-system inventory field UUIDs: Parse the field_list response to identify UUIDs of non-system inventory fields (inf_system=0) that can be targeted for deletion.
5. Send the destructive POST request: For each target field UUID, send a POST to modules/inventory.php?mode=field_delete&uuid=<field-uuid> with the body parameter adm_csrf_token=<captured_token>. A successful response returns {"status":"success","message":"Item field successfully deleted"}.
6. Verify destruction: All rows in adm_inventory_item_data, adm_inventory_field_options, and adm_inventory_fields referencing the deleted field are permanently removed. Repeat for all enumerated field UUIDs to destroy the entire custom inventory schema (GitHub Advisory, Admidio Advisory).

• Network: Unexpected POST requests from non-administrator user sessions to modules/inventory.php?mode=field_delete with a uuid parameter; repeated rapid-fire requests to field_list followed immediately by field_delete requests from the same session.
• Logs: Web server access logs showing POST /modules/inventory.php?mode=field_delete entries from accounts without inventory administrator privileges; multiple such requests in quick succession targeting different UUIDs.
• Database: Sudden mass deletion of rows in adm_inventory_item_data, adm_inventory_field_options, and adm_inventory_fields tables; missing custom field definitions that were previously present; gaps in inf_sequence values in adm_inventory_fields.
• Application Behavior: Inventory exports or item lists silently dropping columns that previously existed; administrators observing that custom fields are missing with no corresponding admin action in audit logs (GitHub Advisory).

Upgrade to Admidio version 5.0.10 or later, which contains the fix for this vulnerability. As a workaround prior to patching, set inventory_module_enabled to a value of 3, 4, or 5 (rather than the default 2) to restrict inventory module access to users with isAdministratorInventory() rights or keeper status, preventing untrusted members from reaching the vulnerable handler. The advisory also recommends adding an isAdministratorInventory() check to the sibling handlers delete_option_entry (line 154), sequence (line 171), item_retire (line 347), item_reinstate (line 364), and item_picture_delete (line 462), which share the same missing-authorization pattern (GitHub Advisory, Admidio Advisory).