File Deletion Vulnerability in Admidio by Admidio Team

CVE-2026-47226

What is CVE-2026-47226?

Admidio, an open-source user management solution, has a vulnerability that allows authenticated members with upload rights to delete files from folders where they only have view access. This occurs because the permission check in 'modules/documents-files.php' improperly evaluates upload rights based on the attacker-supplied 'folder_uuid' URL parameter, ignoring the actual location of the file. As a result, an attacker can leverage their access in one folder to target and permanently delete files in another restricted folder. This issue remains exploitable in versions prior to 5.0.10, despite previous patch attempts.

References