{"id":"CVE-2026-41660","aliases":["EUVD-2026-28272","GHSA-rh3w-4ccx-prf9"],"status":"published","title":"Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTP","description":"Admidio is an open-source user management solution. Prior to version 5.0.9, a logic error in Admidio's two-factor authentication reset inverts the authorization check. Non-admin users cannot remove their own TOTP configuration, but they can remove other users' TOTP, including administrators. A group leader with profile edit rights on an admin account can strip that admin's 2FA. This issue has been patched in version 5.0.9.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00297,"percentile":0.22608,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-04-29T21:49:24Z","modified":"2026-10-28T02:30:51Z","fixes":[{"ecosystem":"Packagist","package":"admidio/admidio","fixed_in":["5.0.9"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"admidio/admidio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.0.8"},{"fixed":"5.0.9"}]}]},{"source":"osv","ecosystem":"Packagist","package":"admidio/admidio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.9"}]}],"versions":["4.1.0","4.1.3","v4.2-Beta.1","v4.2-Beta.2","v4.2-Beta.3","v4.2.0","v4.2.1","v4.2.10","v4.2.11","v4.2.12","v4.2.13","v4.2.14","v4.2.2","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v4.2.7","v4.2.8","v4.2.9","v4.3-Beta.1","v4.3-Beta.3","v4.3-Beta.4","v4.3-Beta.5","v4.3.0","v4.3.1","v4.3.10","v4.3.11","v4.3.12","v4.3.13","v4.3.14","v4.3.15","v4.3.16","v4.3.17","v4.3.2","v4.3.3","v4.3.4","v4.3.5","v4.3.6","v4.3.7","v4.3.8","v4.3.9","v5.0-Beta.1","v5.0-Beta.2","v5.0-Beta.3","v5.0.0","v5.0.1","v5.0.2","v5.0.3","v5.0.4","v5.0.5","v5.0.6","v5.0.7","v5.0.8"]}],"products":[{"vendor":"admidio","product":"admidio"}],"references":[{"url":"https://github.com/Admidio/admidio/security/advisories/GHSA-rh3w-4ccx-prf9","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/Admidio/admidio/releases/tag/v5.0.9","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41660","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rh3w-4ccx-prf9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41660.json","tags":["advisory"]},{"url":"https://github.com/Admidio/admidio","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-41660","title":"Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTP","description":"Admidio is an open-source user management solution. Prior to version 5.0.9, a logic error in Admidio's two-factor authentication reset inverts the authorization check. Non-admin users cannot remove their own TOTP configuration, but they can remove other users' TOTP, including administrators. A group leader with profile edit rights on an admin account can strip that admin's 2FA. This issue has been patched in version 5.0.9.","status":"published","published":"2026-05-07T02:59:29.81Z","modified":"2026-05-07T12:44:52.834Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T13:41:08.498858Z"}],"euvd":[{"id":"EUVD-2026-28272","description":"Admidio is an open-source user management solution. Prior to version 5.0.9, a logic error in Admidio's two-factor authentication reset inverts the authorization check. Non-admin users cannot remove their own TOTP configuration, but they can remove other users' TOTP, including administrators. A group leader with profile edit rights on an admin account can strip that admin's 2FA. This issue has been patched in version 5.0.9.","status":"published","published":"2026-05-07T02:59:29Z","modified":"2026-05-07T12:44:52Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T19:05:15.366699Z"}],"ghsa":[{"id":"GHSA-rh3w-4ccx-prf9","title":"Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP","description":"## Summary\n\nA logic error in Admidio's two-factor authentication reset inverts the authorization check. Non-admin users cannot remove their own TOTP configuration, but they can remove other users' TOTP, including administrators. A group leader with profile edit rights on an admin account can strip that admin's 2FA.\n\n## Details\n\nIn `modules/profile/two_factor_authentication.php` at line 84, the authorization check uses an inverted condition:\n\n```php\n// modules/profile/two_factor_authentication.php line 84\nif (!($gCurrentUser-\u003eisAdministrator() || $gCurrentUserId !== $userId))\n{\n    throw new AdmException('SYS_NO_RIGHTS');\n}\n```\n\nBy De Morgan's law, this condition evaluates as:\n- Blocks when: `NOT isAdministrator() AND $gCurrentUserId === $userId`\n- In practice: blocks non-admins from resetting their OWN 2FA\n- Passes: non-admins resetting OTHER users' 2FA (the opposite of the intended behavior)\n\nThe intended logic should block non-admins from resetting other users' 2FA. The `!==` operator on line 84 should be `===`.\n\nA group leader who holds `hasRightEditProfile()` permission on an admin user (checked earlier in the flow) can exploit this to strip 2FA from administrator accounts, reducing their security to password-only authentication.\n\n## Proof of Concept\n\n1. As `testuser` (a non-admin group leader with edit rights on admin profiles), send:\n\n```http\nPOST /adm_program/modules/profile/two_factor_authentication.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nCookie: ADMIDIO_..._SESSION_ID=\u003ctestuser_session\u003e\n\nmode=reset\u0026user_uuid=\u003cadmin_user_uuid\u003e\n```\n\nResult: the server removes 2FA from the admin account.\n\n2. As `testuser`, attempt to reset their own 2FA:\n\n```http\nPOST /adm_program/modules/profile/two_factor_authentication.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nCookie: ADMIDIO_..._SESSION_ID=\u003ctestuser_session\u003e\n\nmode=reset\u0026user_uuid=\u003ctestuser_user_uuid\u003e\n```\n\nResult: `SYS_NO_RIGHTS` error. The user cannot reset their own 2FA.\n\nThis confirms the authorization logic is inverted.\n\n## Impact\n\nA group leader (or any user with profile edit rights on an admin) can disable two-factor authentication on administrator accounts. This degrades admin account security to password-only, opening the door to credential stuffing or brute force attacks without a 2FA barrier.\n\n## Recommended Fix\n\nChange `!==` to `===` on line 84 of `modules/profile/two_factor_authentication.php`:\n\n```php\n// Fixed condition: block non-admins from resetting OTHER users' 2FA\nif (!($gCurrentUser-\u003eisAdministrator() || $gCurrentUserId === $userId))\n{\n    throw new AdmException('SYS_NO_RIGHTS');\n}\n```\n\n---\n*Found by [aisafe.io](https://aisafe.io)*","status":"published","published":"2026-04-29T21:49:24Z","modified":"2026-05-08T19:55:42Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:40:04.762828Z"}],"nvd":[{"id":"CVE-2026-41660","description":"Admidio is an open-source user management solution. Prior to version 5.0.9, a logic error in Admidio's two-factor authentication reset inverts the authorization check. Non-admin users cannot remove their own TOTP configuration, but they can remove other users' TOTP, including administrators. A group leader with profile edit rights on an admin account can strip that admin's 2FA. This issue has been patched in version 5.0.9.","status":"published","published":"2026-05-07T04:16:29.74Z","modified":"2026-06-17T10:46:57.567Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:17.842772Z"}],"osv":[{"id":"CVE-2026-41660","title":"Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTP","description":"Admidio is an open-source user management solution. Prior to version 5.0.9, a logic error in Admidio's two-factor authentication reset inverts the authorization check. Non-admin users cannot remove their own TOTP configuration, but they can remove other users' TOTP, including administrators. A group leader with profile edit rights on an admin account can strip that admin's 2FA. This issue has been patched in version 5.0.9.","status":"published","published":"2026-05-07T02:59:29.81Z","modified":"2026-10-28T02:30:51.57851066Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:45:03.764807Z"},{"id":"GHSA-rh3w-4ccx-prf9","title":"Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP","description":"## Summary\n\nA logic error in Admidio's two-factor authentication reset inverts the authorization check. Non-admin users cannot remove their own TOTP configuration, but they can remove other users' TOTP, including administrators. A group leader with profile edit rights on an admin account can strip that admin's 2FA.\n\n## Details\n\nIn `modules/profile/two_factor_authentication.php` at line 84, the authorization check uses an inverted condition:\n\n```php\n// modules/profile/two_factor_authentication.php line 84\nif (!($gCurrentUser-\u003eisAdministrator() || $gCurrentUserId !== $userId))\n{\n    throw new AdmException('SYS_NO_RIGHTS');\n}\n```\n\nBy De Morgan's law, this condition evaluates as:\n- Blocks when: `NOT isAdministrator() AND $gCurrentUserId === $userId`\n- In practice: blocks non-admins from resetting their OWN 2FA\n- Passes: non-admins resetting OTHER users' 2FA (the opposite of the intended behavior)\n\nThe intended logic should block non-admins from resetting other users' 2FA. The `!==` operator on line 84 should be `===`.\n\nA group leader who holds `hasRightEditProfile()` permission on an admin user (checked earlier in the flow) can exploit this to strip 2FA from administrator accounts, reducing their security to password-only authentication.\n\n## Proof of Concept\n\n1. As `testuser` (a non-admin group leader with edit rights on admin profiles), send:\n\n```http\nPOST /adm_program/modules/profile/two_factor_authentication.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nCookie: ADMIDIO_..._SESSION_ID=\u003ctestuser_session\u003e\n\nmode=reset\u0026user_uuid=\u003cadmin_user_uuid\u003e\n```\n\nResult: the server removes 2FA from the admin account.\n\n2. As `testuser`, attempt to reset their own 2FA:\n\n```http\nPOST /adm_program/modules/profile/two_factor_authentication.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nCookie: ADMIDIO_..._SESSION_ID=\u003ctestuser_session\u003e\n\nmode=reset\u0026user_uuid=\u003ctestuser_user_uuid\u003e\n```\n\nResult: `SYS_NO_RIGHTS` error. The user cannot reset their own 2FA.\n\nThis confirms the authorization logic is inverted.\n\n## Impact\n\nA group leader (or any user with profile edit rights on an admin) can disable two-factor authentication on administrator accounts. This degrades admin account security to password-only, opening the door to credential stuffing or brute force attacks without a 2FA barrier.\n\n## Recommended Fix\n\nChange `!==` to `===` on line 84 of `modules/profile/two_factor_authentication.php`:\n\n```php\n// Fixed condition: block non-admins from resetting OTHER users' 2FA\nif (!($gCurrentUser-\u003eisAdministrator() || $gCurrentUserId === $userId))\n{\n    throw new AdmException('SYS_NO_RIGHTS');\n}\n```\n\n---\n*Found by [aisafe.io](https://aisafe.io)*","status":"published","published":"2026-04-29T21:49:24Z","modified":"2026-05-08T20:04:35.022435Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:55.877614Z"}]}}