https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 09:16:45 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-47227 <p>Admidio is an open-source user management solution. `modules/categories.php` checks that the supplied `type` parameter (`ANN`, `EVT`, `ROL`, `USF`, …) corresponds to a module the actor administers. The follow-up &#34;is this specific category editable by me&#34; check at lines 56-61 is dead code because it compares `$getType` (a category-type code) against mode names (`edit`/`save`/`delete`); the condition is permanently false, so `$category-&gt;isEditable()` is never invoked. Prior to version 5.0.10, the `delete`, `sequence`, and `save` switch cases load the category by the supplied UUID and act on it without re-checking that the category belongs to a module the actor administers. A user holding only one module-administrator right can therefore destroy or reorder empty categories belonging to *other* modules — for example, an announcements administrator can delete role categories, profile-field categories, or weblink categories that they have no right to touch. Version 5.0.10 fixes the issue.</p> <p>Admidio is an open-source user management solution. `modules/categories.php` checks that the supplied `type` parameter (`ANN`, `EVT`, `ROL`, `USF`, …) corresponds to a module the actor administers. The follow-up &#34;is this specific category editable by me&#34; check at lines 56-61 is dead code because it compares `$getType` (a category-type code) against mode names (`edit`/`save`/`delete`); the condition is permanently false, so `$category-&gt;isEditable()` is never invoked. Prior to version 5.0.10, the `delete`, `sequence`, and `save` switch cases load the category by the supplied UUID and act on it without re-checking that the category belongs to a module the actor administers. A user holding only one module-administrator right can therefore destroy or reorder empty categories belonging to *other* modules — for example, an announcements administrator can delete role categories, profile-field categories, or weblink categories that they have no right to touch. Version 5.0.10 fixes the issue.</p> https://db.gcve.eu/vuln/fkie_cve-2026-47227 https://db.gcve.eu/vuln/ghsa-rwjr-qjj3-mq2f <p><strong>Affected:</strong> Packagist: admidio/admidio</p> <p>## Summary</p> <p>`modules/categories.php` checks that the supplied `type` parameter (`ANN`, `EVT`, `ROL`, `USF`, …) corresponds to a module the actor administers. The follow-up &#34;is this specific category editable by me&#34; check at lines 56-61 is dead code because it compares `$getType` (a category-type code) against mode names (`edit`/`save`/`delete`); the condition is permanently false, so `$category-&gt;isEditable()` is never invoked. The `delete`, `sequence`, and `save` switch cases load the category by the supplied UUID and act on it without re-checking that the category belongs to a module the actor administers. A user holding only one module-administrator right can therefore destroy or reorder empty categories belonging to *other* modules — for example, an announcements administrator can delete role categories, profile-field categories, or weblink categories that they have no right to touch.</p> <p>## Details</p> <p>### vulnerable code</p> <p>`modules/categories.php:40-61`:</p> <p>```php $getMode = admFuncVariableIsValid($_GET, &#39;mode&#39;, &#39;string&#39;, array(&#39;defaultValue&#39; =&gt; &#39;list&#39;, &#39;validValues&#39; =&gt; array(&#39;list&#39;, &#39;edit&#39;, &#39;save&#39;, &#39;delete&#39;, &#39;sequence&#39;))); $getType = admFuncVariableIsValid($_GET, &#39;type&#39;, &#39;string&#39;, array(&#39;validValues&#39; =&gt; array(&#39;ANN&#39;,&#39;AWA&#39;,&#39;EVT&#39;,&#39;FOT&#39;,&#39;LNK&#39;,&#39;ROL&#39;,&#39;USF&#39;,&#39;IVT&#39;))); $getCategoryUUID = admFuncVariableIsValid($_GET, &#39;uuid&#39;, &#39;uuid&#39;);</p> <p>// ch…</p> <p><strong>Affected:</strong> Packagist: admidio/admidio</p> <p>## Summary</p> <p>`modules/categories.php` checks that the supplied `type` parameter (`ANN`, `EVT`, `ROL`, `USF`, …) corresponds to a module the actor administers. The follow-up &#34;is this specific category editable by me&#34; check at lines 56-61 is dead code because it compares `$getType` (a category-type code) against mode names (`edit`/`save`/`delete`); the condition is permanently false, so `$category-&gt;isEditable()` is never invoked. The `delete`, `sequence`, and `save` switch cases load the category by the supplied UUID and act on it without re-checking that the category belongs to a module the actor administers. A user holding only one module-administrator right can therefore destroy or reorder empty categories belonging to *other* modules — for example, an announcements administrator can delete role categories, profile-field categories, or weblink categories that they have no right to touch.</p> <p>## Details</p> <p>### vulnerable code</p> <p>`modules/categories.php:40-61`:</p> <p>```php $getMode = admFuncVariableIsValid($_GET, &#39;mode&#39;, &#39;string&#39;, array(&#39;defaultValue&#39; =&gt; &#39;list&#39;, &#39;validValues&#39; =&gt; array(&#39;list&#39;, &#39;edit&#39;, &#39;save&#39;, &#39;delete&#39;, &#39;sequence&#39;))); $getType = admFuncVariableIsValid($_GET, &#39;type&#39;, &#39;string&#39;, array(&#39;validValues&#39; =&gt; array(&#39;ANN&#39;,&#39;AWA&#39;,&#39;EVT&#39;,&#39;FOT&#39;,&#39;LNK&#39;,&#39;ROL&#39;,&#39;USF&#39;,&#39;IVT&#39;))); $getCategoryUUID = admFuncVariableIsValid($_GET, &#39;uuid&#39;, &#39;uuid&#39;);</p> <p>// ch…</p> https://db.gcve.eu/vuln/ghsa-rwjr-qjj3-mq2f