A logic error in Admidio’s two‑factor authentication reset inverts an authorization check: non‑admin users can’t delete their own TOTP, but they can delete other users’ TOTP, including that of administrators. This flaw, identified as a CWE‑863 authorization error, lets a group leader who has rights to edit an admin profile strip the admin’s 2‑factor authentication. The result is that an attacker with group leader privileges can reduce an administrator’s account to a single‑factor login, enabling subsequent privilege escalation or account takeover if additional credentials are compromised.

The vulnerability affects installations of Admidio predating version 5.0.9. Users with group leader status who can edit admin profiles are able to exploit the flaw and remove an admin’s TOTP configuration. The issue is independent of operating system or deployment environment, as it is a bug in the application logic.

With a CVSS score of 7.1 the vulnerability is in the high‑risk range. Although an EPSS score is not available and the flaw is not listed in the CISA KEV catalog, the exploitation likelihood is concrete: an attacker only needs a legitimate group leader account and permission to modify an admin entry, both common in typical user‑management setups. If successfully exploited, the attacker can render an administrator account accessible with only a password, significantly weakening security controls.