CVE-2026-41660highCWE-863

CVE-2026-41660: falha de alta gravidade em admidio

Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTP

Publicada em

Seguir esta CVE+ Monitorar admidio+ Monitorar admidio/admidio

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.3%
Admidio is an open-source user management solution. Prior to version 5.0.9, a logic error in Admidio's two-factor authentication reset inverts the authorization check. Non-admin users cannot remove their own TOTP configuration, but they can remove other users' TOTP, including administrators. A group leader with profile edit rights on an admin account can strip that admin's 2FA. This issue has been patched in version 5.0.9.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Produtos afetados
Admidio · admidio
CVEs relacionadas — admidio

No mesmo produto, das mais perigosas para as menos.

CVE-2021-43810HIGHCross-site Scripting (XSS) when redirect an urlEPSS 5.1%CVE-2021-32630CRITICALVariousEPSS 1.6%CVE-2020-11004HIGHSQL Injection in AdmidioEPSS 1.5%CVE-2024-38529CRITICALAdmidio Vulnerable to RCE via Arbitrary File Upload in Message AttachmentEPSS 1.2%CVE-2026-32756HIGHAdmidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files ModuleEPSS 1.0%CVE-2024-37906CRITICALAdmidio has Blind SQL Injection in ecard_send.phpEPSS 0.9%