CVE-2026-47226 - Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges
Brief
CVE ID : CVE-2026-47226
Published : Aug. 12, 2026, 12:51 p. m.
- 13 minutes ago
Description : Admidio is an open-source user management solution. Prior to version 5.
- 10, an authenticated Admidio member with upload rights on any one folder can permanently delete files from folders where they have only view access. The authorization check at the top of `modules/documents-files.
php` evaluates upload rights against the attacker-supplied `folder_uuid` URL parameter — not the file's actual parent folder. The `file_delete` handler then only verifies view rights on the file's real location, never upload rights.
By passing a folder they legitimately own in `folder_uuid` while targeting a file in a restricted folder via `file_uuid`, an attacker bypasses the upload-right check entirely and permanently deletes the file.