Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-rh3w-4ccx-prf9
No affected components available
Summary
A logic error in Admidio's two-factor authentication reset inverts the authorization check. Non-admin users cannot remove their own TOTP configuration, but they can remove other users' TOTP, including administrators. A group leader with profile edit rights on an admin account can strip that admin's 2FA.
Details
In modules/profile/two_factor_authentication.php at line 84, the authorization check uses an inverted condition:
// modules/profile/two_factor_authentication.php line 84
if (!($gCurrentUser->isAdministrator() || $gCurrentUserId !== $userId))
{
throw new AdmException('SYS_NO_RIGHTS');
}
By De Morgan's law, this condition evaluates as:
- Blocks when:
NOT isAdministrator() AND $gCurrentUserId === $userId - In practice: blocks non-admins from resetting their OWN 2FA
- Passes: non-admins resetting OTHER users' 2FA (the opposite of the intended behavior)
The intended logic should block non-admins from resetting other users' 2FA. The !== operator on line 84 should be ===.
A group leader who holds hasRightEditProfile() permission on an admin user (checked earlier in the flow) can exploit this to strip 2FA from administrator accounts, reducing their security to password-only authentication.
Proof of Concept
- As
testuser(a non-admin group leader with edit rights on admin profiles), send:
POST /adm_program/modules/profile/two_factor_authentication.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Cookie: ADMIDIO_..._SESSION_ID=<testuser_session>
mode=reset&user_uuid=<admin_user_uuid>
Result: the server removes 2FA from the admin account.
- As
testuser, attempt to reset their own 2FA:
POST /adm_program/modules/profile/two_factor_authentication.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Cookie: ADMIDIO_..._SESSION_ID=<testuser_session>
mode=reset&user_uuid=<testuser_user_uuid>
Result: SYS_NO_RIGHTS error. The user cannot reset their own 2FA.
This confirms the authorization logic is inverted.
Impact
A group leader (or any user with profile edit rights on an admin) can disable two-factor authentication on administrator accounts. This degrades admin account security to password-only, opening the door to credential stuffing or brute force attacks without a 2FA barrier.
Recommended Fix
Change !== to === on line 84 of modules/profile/two_factor_authentication.php:
// Fixed condition: block non-admins from resetting OTHER users' 2FA
if (!($gCurrentUser->isAdministrator() || $gCurrentUserId === $userId))
{
throw new AdmException('SYS_NO_RIGHTS');
}
Found by aisafe.io
The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker needs basic access or low-level privileges. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a high impact on the integrity of the data. There is a low impact on the availability of the system.
Exploitation attempts have been detected. Elevated vigilance and prompt remediation are advised.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard