Admidio is an open-source user management solution. Prior to version 5.0.9, a logic error in Admidio's two-factor authentication reset inverts the authorization…

A critical logic error in Admidio's two-factor authentication reset functionality inverts authorization checks, allowing non-admin users to remove other users' TOTP configurations, including administrators. Group leaders with profile edit rights can strip admin accounts of their 2FA protection. The vulnerability affects versions prior to 5.0.9 and has been patched in the latest release. This represents a significant privilege escalation and authentication bypass issue.