Authorization bypass through user-controlled key in Admidio - CVE-2026-47230

Detailed vulnerability description

The vulnerability allows a remote user to modify file names and descriptions in folders they cannot upload to.

The vulnerability exists due to authorization bypass through user-controlled key in modules/documents-files.php mode file_rename_save and DocumentsService::renameFile() when handling file rename requests with a folder_uuid that is checked separately from the target file_uuid. A remote user can send a specially crafted request referencing an uploadable folder_uuid and a viewable file_uuid from another folder to modify file names and descriptions in folders they cannot upload to.

The issue affects files in folders the user can view but not edit, and the file remains in its original folder while its name and description are changed.

How to mitigate CVE-2026-47230

Sources

• https://github.com/Admidio/admidio/security/advisories/GHSA-q6w3-hpfv-rg36