CVE-2026-47227

Admidio is an open-source user management solution. `modules/categories.php` checks that the supplied `type` parameter (`ANN`, `EVT`, `ROL`, `USF`, …) corresponds to a module the actor administers. The follow-up "is this specific category editable by me" check at lines 56-61 is dead code because it compares `$getType` (a category-type code) against mode names (`edit`/`save`/`delete`); the condition is permanently false, so `$category->isEditable()` is never invoked. Prior to version 5.0.10, the `delete`, `sequence`, and `save` switch cases load the category by the supplied UUID and act on it without re-checking that the category belongs to a module the actor administers. A user holding only one module-administrator right can therefore destroy or reorder empty categories belonging to *other* modules — for example, an announcements administrator can delete role categories, profile-field categories, or weblink categories that they have no right to touch. Version 5.0.10 fixes the issue.

• CWE-639
• CWE-863

• https://github.com/Admidio/admidio/security/advisories/GHSA-rwjr-qjj3-mq2f

Published

Aug 12, 2026

Last Modified

Aug 12, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47221Envoy is an open source edge and service proxy designed for …7.5
• CVE-2026-47222NanaZip is the 7-Zip derivative intended for the modern Wind…5.4
• CVE-2026-47223NanaZip is the 7-Zip derivative intended for the modern Wind…5.4
• CVE-2026-47224NanaZip is the 7-Zip derivative intended for the modern Wind…4.3
• CVE-2026-47225Typesense is a fast, typo-tolerant search engine. Prior to v…6
• CVE-2026-47226Admidio is an open-source user management solution. Prior to…6.5
• CVE-2026-47228Admidio is an open-source user management solution. `modules…5.2
• CVE-2026-47229Admidio is an open-source user management solution. Prior to…5.4
• CVE-2026-4723Use-after-free in the JavaScript Engine component. This vuln…9.8
• CVE-2026-47230Admidio is an open-source user management solution. Prior to…6.5
• CVE-2026-47231Admidio is an open-source user management solution. Prior to…8.1
• CVE-2026-47232Admidio is an open-source user management solution. Prior to…4.3