GitHub Security Advisory: GHSA-rmpj-3x5m-9m5f
Package: admidio/admidio (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 5.0.0, <= 5.0.6
Patched in: 5.0.7

Summary: Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion

Details:
## Summary

The documents and files module in Admidio does not verify whether the current user has permission to delete folders or files. The `folder_delete` and `file_delete` action handlers in `modules/documents-files.php` only perform a VIEW authorization check (`getFolderForDownload` / `getFileForDownload`) before calling `delete()`, and they never validate a CSRF token. Because the target UUIDs are read from `$_GET`, deletion can be triggered by a plain HTTP GET request. When the module is in public mode (`documents_files_module_enabled = 1`) and a folder is marked public (`fol_public = true`), an unauthenticated attacker can permanently destroy the entire document library. Even when the module requires login, any user with view-only access can delete content they are only permitted to read.

## Details

### Module Access Check

File: `D:/bugcrowd/admidio/repo/modules/documents-files.php`, lines 72-76

The module only blocks unauthenticated access when the setting is 2 (members-only). When the setting is 1 (public), no login is required to reach any action handler:

```php
if ($gSettingsManager->getInt('documents_files_module_enabled') === 0) {
    throw new Exception('SYS_MODULE_DISABLED');
} elseif ($gSettingsManager->getInt('documents_files_module_enabled') === 2 && !$gValidLogin) {
    throw new Exception('SYS_NO_RIGHTS');
}
```

### Vulnerable Code Path 1: Folder Deletion

File: `D:/bugcrowd/admidio/repo/modules/documents-files.php`, lines 122-133

```php
case 'folder_delete':
    if ($getFolderUUID === '') {
        throw new Exception('SYS_INVALID_PAGE_VIEW');
    } else {
        $folder = new Folder($gDb);
        $folder->getFolderForDownload($getFolderUUID);  // VIEW check only

        $folder->delete();                               // no CSRF token, no upload/admin check
        echo json_encode(array('status' => 'success'));
    }
    break;
```

The target UUID is read exclusively from `$_GET` at line 64:

```php
$getFolderUUID = admFuncVariableIsValid($_GET, 'folder_uuid', 'uuid', ...);
```

### Vulnerable Code Path 2: File Deletion

File: `D:/bugcrowd/admidio/repo/modules/documents-files.php`, lines 150-161

```php
case 'file_delete':
    if ($getFileUUID === '') {
        throw new Exception('SYS_INVALID_PAGE_VIEW');
    } else {
        $file = new File($gDb);
        $file->getFileForDownload($getFileUUID);  // VIEW check only

        $file->delete();                           // no CSRF token, no upload/admin check
        echo json_encode(array('status' => 'success'));
    }
    break;
```

Same pattern as `folder_delete`. The file UUID is also read from `$_GET` (line 69).

### getFolderForDownload Grants VIEW Access to Public Folders Without Login

File: `D:/bugcrowd/admidio/repo/src/Documents/Entity/Folder.php`, lines 432-438

```php
// If the folder is public (and the file is not locked) => allow
if ($this->getValue('fol_public') && !$this->getValue('fol_locked')) {
    return true;
}
```

This is the correct check