Admidio opened an inventory fields API path that checks only a CSRF token and performs a delete operation on the field definition and all its data, but omits the administrator permission check that exists for other inventory actions. The missing control means any authenticated user can permanently destroy an inventory field, thereby deleting all stored values that referenced it and potentially breaking application functionality. The flaw is a classic access‑control bypass (CWE‑1281) that results in loss of data integrity and availability for the application.

Admidio 5.0.9 is known to contain the issue; later releases such as 5.0.10 include the correct guard. Earlier or other releases are not documented as affected.

The CVSS score of 6.5 indicates a moderate risk; the vulnerability can be exploited by any user with a valid session, simply by sending a POST request with a correct CSRF token to mode=field_delete. EPSS data is not available, and the feature is not listed in the CISA KEV catalog. The lack of an administrator check means exploitation does not require additional privileges, making the attack path straightforward for users who have legitimate access to the site.