Authorization bypass through user-controlled key in Admidio - CVE-2026-47226

Detailed vulnerability description

The vulnerability allows a remote user to delete files from folders where they only have view access.

The vulnerability exists due to authorization bypass through a user-controlled key in modules/documents-files.php when handling file_delete requests with an attacker-supplied folder_uuid that does not match the file's actual parent folder. A remote user can send a crafted file_delete request using a folder UUID they control and a target file UUID from another folder to delete files from folders where they only have view access.

Exploitation requires a valid member account, upload rights on at least one folder, view rights on the target folder, and knowledge of the target file UUID.

How to mitigate CVE-2026-47226

Sources

• https://github.com/Admidio/admidio/security/advisories/GHSA-qc4c-hrmc-4f78
• https://github.com/Admidio/admidio/security/advisories/GHSA-rmpj-3x5m-9m5f