CVE-2026-47230 in Admidio
Summary
by MITRE • 08/12/2026
Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` mode `file_rename_save` shares the same root-cause shape as the cross-folder move bug (`05-documents-cross-folder-move-idor.md`): the top-level rights check at lines 79-89 validates `hasUploadRight()` on the URL parameter `folder_uuid`, but the rename operation acts on `file_uuid` — a separate URL parameter — without re-checking the folder that actually contains the file. `DocumentsService::renameFile()` resolves the target file via `getFileForDownload()` (which permits view-readable files) but does not require upload right on the file's source folder. Result: a user with upload right on any folder A can rename a file in folder B as long as they can view it. They can also overwrite the file's description. Version 5.0.10 contains a fix.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability identified in Admidio versions prior to 5.0.10 represents a critical access control flaw that stems from improper privilege validation during file rename operations within the documents-files module. This issue manifests through a classic identity-based access control weakness where the system fails to properly validate folder permissions when executing file renaming actions, creating an unauthorized modification pathway that directly violates fundamental security principles of least privilege and proper authorization enforcement.
The technical root cause lies in the inconsistent handling of permission checks within the `file_rename_save` mode of `modules/documents-files.php`. The system performs an initial rights validation using `hasUploadRight()` on the `folder_uuid` parameter, but this check occurs at a level that does not align with the actual file operation being performed. When a user attempts to rename a file, the system uses the `file_uuid` parameter to identify the target file, yet fails to re-validate folder permissions for the source location of that file. This disconnect allows attackers to exploit a cross-folder privilege escalation scenario where they can manipulate files in directories they do not have explicit upload rights to.
The vulnerability enables a specific type of privilege escalation attack pattern that aligns with CWE-285 (Improper Authorization) and can be classified under ATT&CK technique T1078.004 (Valid Accounts: Cloud Accounts) when leveraging legitimate user permissions to perform unauthorized actions. The `DocumentsService::renameFile()` method specifically resolves target files through `getFileForDownload()`, which only requires view-readability permissions rather than the more restrictive upload rights needed for modification operations. This design flaw allows attackers with upload privileges on one folder to rename files located in completely different folders, provided they can access those files for viewing purposes.
The operational impact of this vulnerability extends beyond simple file renaming to include potential data integrity compromise and unauthorized content modification. Attackers could overwrite file descriptions, potentially including malicious metadata or misleading information that could affect system administrators' decision-making processes. The vulnerability affects the core functionality of document management within Admidio, creating a persistent security risk that allows unauthorized users to modify organizational files without proper authorization. This weakness particularly impacts environments where multiple users have varying permission levels and where file organization relies on folder-based access controls.
The fix implemented in version 5.0.10 addresses this vulnerability by ensuring proper permission validation during the rename operation, requiring upload rights not only for the target folder but also for the source folder containing the file being renamed. This change aligns with industry best practices for privilege management and ensures that all file operations maintain consistent authorization checks throughout their execution path. Organizations using Admidio should prioritize immediate upgrade to version 5.0.10 or later, as this vulnerability represents a significant risk to document integrity and access control enforcement within the system. The fix demonstrates proper remediation techniques that align with defensive programming principles and proper security architecture practices, ensuring that file operations maintain consistent authorization boundaries across all related folders and file locations.