CVE-2026-41660: Admidio/admidio Admidio Has Inverted 2FA Reset Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rh3w-4ccx-prf9",
  "modified" : "2026-05-08T19:55:40Z",
  "published" : "2026-04-29T21:49:24Z",
  "aliases" : [ "CVE-2026-41660" ],
  "summary" : "Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP",
  "details" : "## Summary\n\nA logic error in Admidio's two-factor authentication reset inverts the authorization check. Non-admin users cannot remove their own TOTP configuration, but they can remove other users' TOTP, including administrators. A group leader with profile edit rights on an admin account can strip that admin's 2FA.\n\n## Details\n\nIn `modules/profile/two_factor_authentication.php` at line 84, the authorization check uses an inverted condition:\n\n```php\n// modules/profile/two_factor_authentication.php line 84\nif (!($gCurrentUser->isAdministrator() || $gCurrentUserId !== $userId))\n{\n    throw new AdmException('SYS_NO_RIGHTS');\n}\n```\n\nBy De Morgan's law, this condition evaluates as:\n- Blocks when: `NOT isAdministrator() AND $gCurrentUserId === $userId`\n- In practice: blocks non-admins from resetting their OWN 2FA\n- Passes: non-admins resetting OTHER users' 2FA (the opposite of the intended behavior)\n\nThe intended logic should block non-admins from resetting other users' 2FA. The `!==` operator on line 84 should be `===`.\n\nA group leader who holds `hasRightEditProfile()` permission on an admin user (checked earlier in the flow) can exploit this to strip 2FA from administrator accounts, reducing their security to password-only authentication.\n\n## Proof of Concept\n\n1. As `testuser` (a non-admin group leader with edit rights on admin profiles), send:\n\n```http\nPOST /adm_program/modules/profile/two_factor_authentication.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nCookie: ADMIDIO_..._SESSION_ID=<testuser_session>\n\nmode=reset&user_uuid=<admin_user_uuid>\n```\n\nResult: the server removes 2FA from the admin account.\n\n2. As `testuser`, attempt to reset their own 2FA:\n\n```http\nPOST /adm_program/modules/profile/two_factor_authentication.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nCookie: ADMIDIO_..._SESSION_ID=<testuser_session>\n\nmode=reset&user_uuid=<testuser_user_uuid>\n```\n\nResult: `SYS_NO_RIGHTS` error. The user cannot reset their own 2FA.\n\nThis confirms the authorization logic is inverted.\n\n## Impact\n\nA group leader (or any user with profile edit rights on an admin) can disable two-factor authentication on administrator accounts. This degrades admin account security to password-only, opening the door to credential stuffing or brute force attacks without a 2FA barrier.\n\n## Recommended Fix\n\nChange `!==` to `===` on line 84 of `modules/profile/two_factor_authentication.php`:\n\n```php\n// Fixed condition: block non-admins from resetting OTHER users' 2FA\nif (!($gCurrentUser->isAdministrator() || $gCurrentUserId === $userId))\n{\n    throw new AdmException('SYS_NO_RIGHTS');\n}\n```\n\n---\n*Found by [aisafe.io](https://aisafe.io)*",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "admidio/admidio"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "5.0.9"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.0.8"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/Admidio/admidio/security/advisories/GHSA-rh3w-4ccx-prf9"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-41660"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/Admidio/admidio"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Admidio/admidio/releases/tag/v5.0.9"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-863" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-29T21:49:24Z",
    "nvd_published_at" : "2026-05-07T04:16:29Z"
  }
}