CVE-2026-47227 Admidio CVE debrief

Who should care

Defenders managing Admidio installations, especially those with multiple module administrators, should assess exposure and apply the fix to prevent unauthorized actions on categories.

Why it matters

CVE-2026-47227 allows an administrator of one module in Admidio to perform unauthorized actions on categories in other modules they do not administer. Defenders should verify exposure and apply the fix to prevent potential data integrity issues.

• An administrator of one module can delete categories in another module they do not administer
• An administrator of one module can reorder categories in another module they do not administer
• An administrator of one module can save changes to categories in another module they do not administer
• Verify Admidio version and module administrator configurations to ensure exposure is addressed

Technical summary

The vulnerability in Admidio allows a user with administrator rights to one module to perform actions on categories belonging to other modules they do not administer. This is due to a dead code check in `modules/categories.php` that prevents the `isEditable()` method from being invoked. The issue was fixed in version 5.0.10. An administrator of one module can delete categories in another module they do not administer, reorder categories in another module they do not administer, or save changes to categories in another module they do not administer.

Defensive priority

Defenders should prioritize verifying exposure and applying the fix, especially in environments with multiple module administrators.

Recommended defensive actions

• Verify exposure by checking Admidio versions and module administrator configurations
• Apply the fix by upgrading to version 5.0.10 or later
• Review and restrict module administrator rights to minimize potential impact
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix. However, additional information on exploitation or affected versions is limited. Defenders should verify Admidio version and module administrator configurations to ensure exposure is addressed. The vulnerability allows an administrator of one module to delete, reorder, or save categories in another module they do not administer due to a dead code check in `modules/categories.php`.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.