CVE-2026-41658

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41658
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41658.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-41658
Aliases
Published
2026-05-07T02:58:27Z
Modified
2026-08-12T03:51:27Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Admidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items
Details

Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio inventory module enforces authorization for destructive operations (delete, retire, reinstate) only in the UI layer by conditionally rendering buttons. The backend POST handlers at modules/inventory.php for item_delete, item_retire, item_reinstate, item_picture_upload, item_picture_save, and item_picture_delete perform CSRF validation but never check whether the requesting user is an inventory administrator. Any authenticated user who can access the inventory module can permanently delete any inventory item and all its associated data. This issue has been patched in version 5.0.9.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41658.json"
}
References

Affected packages

Git / github.com/admidio/admidio

Affected ranges

Type
GIT
Repo
https://github.com/admidio/admidio
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d39915697e6e0be04d02d55a46c631f53013aea6
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.0.9"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

3.*
3.0-Beta.1
3.0-Beta.3
v3.*
v3.0.6
v3.1.5
v3.2-Beta.1
Other
v34
v4.*
v4.0-Beta.1
v4.1-Beta.2
v4.3-Beta.1
v5.*
v5.0-Beta.1
v5.0-Beta.2
v5.0-Beta.3
v5.0.0
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.0.6
v5.0.7
v5.0.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41658.json"