The vulnerability in Admidio’s inventory module permits any authenticated user to perform destructive actions—such as deleting, retiring, or reinstating inventory items—without proper authorization checks on the backend. Although the UI layer hides these actions for non‑administrators, the server‑side endpoints lack any validation of the user’s inventory privileges. Consequently, an attacker who has simply logged in can irrevocably delete inventory records and associated data, impairing data integrity and availability. The weakness is identified as a Missing Authorization flaw (CWE‑862).

Installed versions of Admidio earlier than 5.0.9 are affected. The issue is present in the inventory module’s POST handlers for item_delete, item_retire, item_reinstate, item_picture_upload, item_picture_save, and item_picture_delete. Users who can access the inventory module, regardless of their role, can exploit the flaw. The patch released in version 5.0.9 addresses this problem.

The CVSS score of 6.5 indicates a moderate severity risk when an authenticated user can remove inventory data. No EPSS score is available, so the current probability of exploitation is unknown, but the lack of authorization checks makes the vulnerability highly exploitable in any environment where users can reach the inventory module. The vulnerability is not currently listed in the CISA KEV catalog, suggesting there are no publicly confirmed exploits at this time. The most likely attack vector is a legitimate authenticated session combined with either the public inventory interface or an API endpoint accessed through a web browser or automated client.