PT-2026-37146 · Admidio · Admidio

Adrgs · Published 2026-04-29 · Updated 2026-05-07 · CVE-2026-41662

Positive Technologies (AI Summary)

CVSS v3.1

5.2

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.9

Description An issue exists where the Role::stopMembership() function fails to verify if removing a user from the administrator role leaves the system with zero administrators. While the deprecated Membership::stopMembership() function contains a safety check to prevent this, the current code path bypasses it. This allows an administrator to remove the last remaining other administrator, potentially locking the entire system out of administrative access. This can occur through sequential removals, where two administrators remove each other, resulting in no users remaining in the administrator role. The vulnerability is located in the Role::stopMembership() function within src/Roles/Entity/Role.php and can be triggered via the endpoint "/modules/profile/profile function.php" using the mode, user uuid, and role uuid parameters.

Recommendations Update to version 5.0.9. As a temporary workaround, restrict access to the "/modules/profile/profile function.php" endpoint or limit the number of users with administrator privileges to minimize the risk of total lockout.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2026-41662

GHSA-C7XM-R6VJ-8VG6

Affected Products

Admidio

References · 7

• 🔥 https://github.com/Admidio/admidio/security/advisories/GHSA-c7xm-r6vj-8vg6 · Exploit
• https://osv.dev/vulnerability/GHSA-c7xm-r6vj-8vg6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41662 · Security Note
• https://github.com/Admidio/admidio · Note
• https://github.com/Admidio/admidio/releases/tag/v5.0.9 · Note
• https://twitter.com/CVEnew/status/2052400846466609367 · Twitter Post
• https://twitter.com/CVEarity/status/2052404313277010326 · Twitter Post