CVE-2026-47226 in Admidio
Summary
by MITRE • 08/12/2026
Admidio is an open-source user management solution. Prior to version 5.0.10, an authenticated Admidio member with upload rights on any one folder can permanently delete files from folders where they have only view access. The authorization check at the top of `modules/documents-files.php` evaluates upload rights against the attacker-supplied `folder_uuid` URL parameter — not the file's actual parent folder. The `file_delete` handler then only verifies view rights on the file's real location, never upload rights. By passing a folder they legitimately own in `folder_uuid` while targeting a file in a restricted folder via `file_uuid`, an attacker bypasses the upload-right check entirely and permanently deletes the file. This is an incomplete fix of GHSA-rmpj-3x5m-9m5f, which was patched in v5.0.7 but remains exploitable in v5.0.9. User should upgrade to v5.0.10 to receive an updated fix.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability described represents a critical authorization bypass flaw in Admidio version 5.0.9 that stems from improper access control validation within the file deletion mechanism. This issue falls under CWE-284 which specifically addresses inadequate access control implementations, where the system fails to properly verify that users possess the necessary privileges to perform certain operations on resources. The flaw exists in the modules/documents-files.php file where the authorization check is conducted against an attacker-supplied folder_uuid parameter rather than the actual parent folder of the targeted file. This fundamental misalignment between the validation context and the operation being performed creates a pathway for authenticated users to exploit the system's permission model.
The technical execution of this vulnerability requires an attacker to possess both upload rights on one folder and view access to another folder containing the target file. The attack vector exploits the mismatch between the folder_uuid parameter used for authorization checks and the actual file location that undergoes deletion operations. When processing file deletions, the system validates permissions against the folder specified in folder_uuid but then proceeds to delete a file from a completely different folder identified by file_uuid. This discrepancy allows the attacker to bypass upload permission requirements entirely since they can supply their own folder UUID that they legitimately own while targeting files in folders where they only have view access.
The operational impact of this vulnerability is severe as it enables permanent data destruction capabilities for authenticated users who should not possess such privileges. An attacker could systematically delete important documents, images, or other valuable content from restricted folders without triggering any authorization warnings. This represents a complete breakdown of the principle of least privilege, where users can perform destructive operations beyond their intended access level. The vulnerability particularly affects organizations relying on Admidio for document management where sensitive information is stored in restricted directories that should only be accessible to specific user groups with appropriate permissions.
This issue constitutes an incomplete remediation of a previously identified vulnerability GHSA-rmpj-3x5m-9m5f, which was patched in version 5.0.7 but not fully addressed in the subsequent 5.0.9 release. The security regression demonstrates poor patch management and insufficient validation of authorization logic updates. Organizations using Admidio should immediately upgrade to version 5.0.10 where a proper fix has been implemented that correctly validates permissions against the actual file location rather than relying on potentially manipulated folder UUID parameters. The ATT&CK framework categorizes this as privilege escalation through access control bypass, specifically targeting the privilege escalation technique where adversaries gain elevated permissions by exploiting flaws in authorization mechanisms. This vulnerability underscores the critical importance of thorough testing and validation when implementing security patches to prevent regression issues that leave systems vulnerable to previously addressed threats.