p PatchFirst

CVE-2026-41660

CVE-2026-41660 · Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTP

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Admidio is an open-source user management solution. Prior to version 5.0.9, a logic error in Admidio's two-factor authentication reset inverts the authorization check. Non-admin users cannot remove their own TOTP configuration, but they can remove other users' TOTP, including administrators. A group leader with profile edit rights on an admin account can strip that admin's 2FA. This issue has been patched in version 5.0.9.

CVSS 7.1 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • admidio

    Versions
    • < 5.0.9: Affected

    No fix published

  • admidio/admidio Packagist

    Versions
    • 4.1.0
    • 4.1.3
    • v4.2-Beta.1
    • v4.2-Beta.2
    • v4.2-Beta.3
    • v4.2.0
    • v4.2.1
    • v4.2.10
    • v4.2.11
    • v4.2.12
    • v4.2.13
    • v4.2.14
    • v4.2.2
    • v4.2.3
    • v4.2.4
    • v4.2.5
    • v4.2.6
    • v4.2.7
    • v4.2.8
    • v4.2.9
    • v4.3-Beta.1
    • v4.3-Beta.3
    • v4.3-Beta.4
    • v4.3-Beta.5
    • v4.3.0
    • v4.3.1
    • v4.3.10
    • v4.3.11
    • v4.3.12
    • v4.3.13
    • v4.3.14
    • v4.3.15
    • v4.3.16
    • v4.3.17
    • v4.3.2
    • v4.3.3
    • v4.3.4
    • v4.3.5
    • v4.3.6
    • v4.3.7
    • v4.3.8
    • v4.3.9
    • v5.0-Beta.1
    • v5.0-Beta.2
    • v5.0-Beta.3
    • v5.0.0
    • v5.0.1
    • v5.0.2
    • v5.0.3
    • v5.0.4
    • v5.0.5
    • v5.0.6
    • v5.0.7
    • v5.0.8
    Affected ranges
    • ECOSYSTEM: < 5.0.9

    Update to 5.0.9

Original sources

Check your server →