PT-2026-37142 · Admidio · Admidio

Offset · Published 2026-04-29 · Updated 2026-05-07 · CVE-2026-41658

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.9

Description The inventory module fails to properly enforce authorization for destructive operations on the backend, relying instead on the UI layer to hide buttons from non-administrative users. While the system performs CSRF validation, it does not verify if the requesting user has inventory administrator privileges before executing actions. Consequently, any authenticated user with access to the inventory module can permanently delete inventory items and all associated data, as well as retire or reinstate items and manage item pictures.

Technical details include the following:

• API Endpoint: 'modules/inventory.php'
• Vulnerable Parameters: item delete, item retire, item reinstate, item picture upload, item picture save, and item picture delete
• Vulnerable Function: isAdministratorInventory() is not called to verify permissions before executing destructive tasks.

Recommendations Update to version 5.0.9. As a temporary workaround, restrict access to the 'modules/inventory.php' endpoint or the inventory module to only trusted administrative users.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-41658

GHSA-XQV4-XM7H-52CV

Affected Products

Admidio

References · 7

• 🔥 https://github.com/Admidio/admidio/security/advisories/GHSA-xqv4-xm7h-52cv · Exploit
• https://osv.dev/vulnerability/GHSA-xqv4-xm7h-52cv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41658 · Security Note
• https://github.com/Admidio/admidio · Note
• https://github.com/Admidio/admidio/releases/tag/v5.0.9 · Note
• https://twitter.com/CVEnew/status/2052400850799321235 · Twitter Post
• https://twitter.com/CVEarity/status/2052393185952112768 · Twitter Post