The vulnerability lies in the Admidio role management code, where an administrator can call Role::stopMembership() to remove another administrator without the system checking that the action would leave at least one remaining administrator. Because the deprecated method containing the safety guard is bypassed, an admin can remove the last other administrator, effectively locking the system out of any administrative interface. This leads to a denial of administrative access, which can destabilize operations or force a restoration from backup, and represents a medium severity risk as indicated by the CVSS score.

The affected application is Admidio. Versions released before 5.0.9 are vulnerable. Any deployment using Admidio before this patch is subject to the issue.

The CVSS score of 5.2 classifies the vulnerability as medium but the lack of an EPSS score means current exploitation likelihood is unknown. The issue does not require network‑side conditions beyond having administrator privileges; a single administrative account can perform the removal. The impact is isolated to the administration subsystem and can permanently lock out all administrators if no backup account exists. The vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed public exploits as of now.