CVE-2026-47226

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.10

Description An authenticated member with upload rights to any single folder can permanently delete files from other folders where they only have view access. This occurs because the authorization check in modules/documents-files.php validates upload rights using the folder uuid URL parameter provided by the user rather than the actual parent folder of the target file. The file delete handler subsequently verifies only view rights on the file's location, allowing an attacker to bypass upload-right restrictions by providing a folder uuid for a folder they legitimately own while targeting a file in a restricted folder via the file uuid parameter.

Recommendations Upgrade to version 5.0.10. As a temporary mitigation, restrict user upload rights to the minimum necessary and audit folder access permissions to minimize the risk of unauthorized file deletion.