CVE-2026-47227

CVE-2026-47227 in Admidio's categories.php appears as a straightforward IDOR — an attacker with announcements-module admin rights can delete categories belonging to other modules (events, roles, user fields) by manipulating the category_uuid parameter. The CVSS and EPSS scores treat this as an isolated authorization gap. They are underselling it. The proximate cause is dead code: an unreachable `isEditable()` call at lines 56-61 that was orphaned when the codebase was refactored, leaving three switch cases (delete, copy, move) without resource-level authorization while the 'edit' path happened to remain protected. But the root cause is architectural, not accidental. The application performs a module-level gate at entry (verifying the user administers 'some' module) and then loads and mutates an arbitrary category by UUID without verifying that category belongs to a module the user actually administers. This is insecure direct object reference logic operating under the implicit assumption that an entry-point gate protects all downstream operations. That assumption is the real signal. Admidio's category system uses an `ANN`/`EVT`/`ROL`/`USF` taxonomy — each module-administrator role was added incrementally, and each time a developer assumed the top-level type check covered everything. The dead authorization check in categories.php is a fossil from an earlier evolutionary stage where explicit per-resource checks existed. The codebase evolved, the checks were orphaned, and nobody caught the drift. The practical exploitability constraint — categories must be empty — limits impact in single-admin deployments but thins rapidly in distributed administration. Organizations using Admidio (clubs, churches, small organizations) frequently have abandoned categories, role categories that accumulate and get orphaned, and module administrators with narrow scopes acting on shared taxonomy. Deleting a role category as an announcements administrator doesn't just remove a label; it can orphan role definitions, invalidate permission hierarchies, and corrupt audit trails that reference those category IDs. The fix to version 5.0.10 matters, but it addresses one instance, not the pattern. The critical questions are: whether other Admidio endpoints accept UUIDs and perform module-gated operations without re-authorizing at the resource level; whether the 5.0.10 fix makes the authorization contract explicit (a re-authorization check at each resource operation) or just patches the specific parameters in categories.php; and whether dead authorization guards elsewhere in the 5.0.x branch are waiting to be orphaned further by well-intentioned refactors. Treat this CVE as a diagnostic window into authorization hygiene, not a one-off patch. Audit other UUID-accepting endpoints for the same module-gate-then-mutate pattern. The CVE closes one instance; the question is whether the development team has a systematic process for catching the next one before it arrives in a future CVE.

Reviewed through automated stages and approved by a human before publication.