Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges
Date: 2026-05
Affected: composer/admidio/admidio
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-32817
CVE-2026-47226
CWE: CWE-639
CWE-862
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

### Summary An authenticated Admidio member with upload rights on **any one folder** can permanently delete files from folders where they have only view access. The authorization check at the top of `modules/documents-files.php` evaluates upload rights against the attacker-supplied `folder_uuid` URL parameter — not the file's actual parent folder. The `file_delete` handler then only verifies view rights on the file's real location, never upload rights. By passing a folder they legitimately own in `folder_uuid` while targeting a file in a restricted folder via `file_uuid`, an attacker bypasses the upload-right check entirely and permanently deletes the file. This is an **incomplete fix** of [GHSA-rmpj-3x5m-9m5f](https://github.com/Admidio/admidio/security/advisories/GHSA-rmpj-3x5m-9m5f), which was patched in v5.0.7 but remains exploitable in v5.0.9. **Affected Version:** Admidio v5.0.9 --- ### Details **Root Cause File:** `modules/documents-files.php` **Issue 1 — `folder_uuid` is not required for `file_delete` mode (line 67):** ```php $getFolderUUID = admFuncVariableIsValid($_GET, 'folder_uuid', 'uuid', array( 'requireValue' => !in_array($getMode, array('list', 'file_delete', 'download')) )); ``` **Issue 2 — The top-level upload-right check loads the folder from the attacker-controlled URL parameter, not the file's actual parent folder (lines 79–88):** ```php if ($getMode != 'list' && $getMode != 'download') { $folder = new Folder($gDb); $folder->getFold


Mitigations:

Architectural layers (MAESTRO):