Admidio is an open‑source user management solution that allows administrators to manage users, groups, and modules. In versions prior to 5.0.10, the script modules/categories.php performs a dead authorization check that permits a user who has the module‑administrator right for any single module to delete or reorder categories belonging to other modules. This can lead to accidental or intentional deletion of category data or rearrangement of the category tree, potentially disrupting other modules and affecting the integrity of user data.

The flaw affects installations of Admidio prior to version 5.0.10. Administrators who have the module‑administrator role for one module can exploit the vulnerability regardless of the categories’ parent module. The fix, released in version 5.0.10, restores proper ownership verification before category operations.

The CVSS score of 6.5 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalogue, so exploit data is not publicly documented. Still, because the issue requires only authenticated access with module‑administrator privileges, a malicious administrator could delete or reorder categories belonging to other modules, leading to data loss or configuration breakage. The exploitation path involves sending an HTTP request to modules/categories.php with the delete, sequence, or save action and the UUID of a target category, and is not mitigated by typical access restrictions beyond module-level rights.