CVE-2026-41660 HIGH

CVE-2026-41660: Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTP

Vendor Admidio
Product admidio
Weakness CWE-863 · Incorrect authorization
Published May 7, 2026
Last update May 7, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

What the vulnerability does

01Description

Admidio is an open-source user management solution. Prior to version 5.0.9, a logic error in Admidio's two-factor authentication reset inverts the authorization check. Non-admin users cannot remove their own TOTP configuration, but they can remove other users' TOTP, including administrators. A group leader with profile edit rights on an admin account can strip that admin's 2FA. This issue has been patched in version 5.0.9.

Key dates

02Disclosure timeline

May 7, 2026 CVE published
May 7, 2026 Record updated