Admidio is an open-source user management solution. Prior to version 5.0.9, a logic error in Admidio's two-factor authentication reset inverts the authorization check. Non-admin users cannot remove their own TOTP configuration, but they can remove other users' TOTP, including administrators. A group leader with profile edit rights on an admin account can strip that admin's 2FA. This issue has been patched in version 5.0.9.

Affected: Packagist: admidio/admidio

## Summary

A logic error in Admidio's two-factor authentication reset inverts the authorization check. Non-admin users cannot remove their own TOTP configuration, but they can remove other users' TOTP, including administrators. A group leader with profile edit rights on an admin account can strip that admin's 2FA.

## Details

In `modules/profile/two_factor_authentication.php` at line 84, the authorization check uses an inverted condition:

```php // modules/profile/two_factor_authentication.php line 84 if (!($gCurrentUser->isAdministrator() || $gCurrentUserId !== $userId)) { throw new AdmException('SYS_NO_RIGHTS'); } ```

By De Morgan's law, this condition evaluates as: - Blocks when: `NOT isAdministrator() AND $gCurrentUserId === $userId` - In practice: blocks non-admins from resetting their OWN 2FA - Passes: non-admins resetting OTHER users' 2FA (the opposite of the intended behavior)

The intended logic should block non-admins from resetting other users' 2FA. The `!==` operator on line 84 should be `===`.

A group leader who holds `hasRightEditProfile()` permission on an admin user (checked earlier in the flow) can exploit this to strip 2FA from administrator accounts, reducing their security to password-only authentication.

## Proof of Concept

1. As `testuser` (a non-admin group leader with edit rights on admin profiles), send:

```http POST /adm_program/modules/profile/two_factor_authentication.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Cookie:…