In the inventory module of Admidio, a POST parameter named "imported" can be set to true to bypass both CSRF token validation and server‑side form validation. An authenticated user can therefore craft a direct POST request to the item_save endpoint and store arbitrary inventory data without the usual checks. This flaw permits unauthorized modification of inventory records, undermining data integrity and potentially allowing malicious changes to the system’s contents. The vulnerability is a classic case of inadequate input validation (CWE-20) coupled with a server‑side CSRF bypass (CWE-352).

Admidio versions prior to 5.0.8 are affected. The flaw resides solely in the inventory module’s item_save endpoint. The issue has been resolved by patching the software to version 5.0.8 or later.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, further implying limited known exploitation activity. Exploitation requires an authenticated session; an attacker who obtains valid credentials can send a crafted request to the vulnerable endpoint and effect arbitrary changes to inventory data. While the risk is moderate, the low exploitation likelihood makes timely patching a prudent priority to mitigate potential data integrity issues.