Description

Admidio is an open-source user management solution. Prior to version 5.0.10, an authenticated Admidio member with upload rights on any one folder can permanently delete files from folders where they have only view access. The authorization check at the top of `modules/documents-files.php` evaluates upload rights against the attacker-supplied `folder_uuid` URL parameter — not the file's actual parent folder. The `file_delete` handler then only verifies view rights on the file's real location, never upload rights. By passing a folder they legitimately own in `folder_uuid` while targeting a file in a restricted folder via `file_uuid`, an attacker bypasses the upload-right check entirely and permanently deletes the file. This is an incomplete fix of GHSA-rmpj-3x5m-9m5f, which was patched in v5.0.7 but remains exploitable in v5.0.9. User should upgrade to v5.0.10 to receive an updated fix.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-12T13:17:22.467Z",
  "pubdate": "2026-08-12T13:17:22.467Z",
  "executiveSummary": "An improper authorization vulnerability exists in Admidio prior to version 5.0.10, specifically representing an incomplete fix for GHSA-rmpj-3x5m-9m5f. The vulnerability enables authenticated members who possess upload privileges on any single directory to execute permanent file deletions across arbitrary directories where they possess only read or view access. The impact of this security flaw includes unauthorized data destruction, integrity degradation, and the potential removal of critical system or user documents. The affected product is Admidio, impacting all versions prior to 5.0.10. Risk implications are moderate to high depending on the sensitivity of the targeted documents and data governance policies. Attacker capabilities require authenticated access to the application alongside legitimate upload permissions on at least one arbitrary folder. Exploitation requirements mandate that the attacker supplies a manipulated folder context via a URL parameter while concurrently referencing target file identifiers residing in restricted directories, thereby exploiting decoupled authorization checks within the document management module.",
  "technicalDetails": "The vulnerability resides within the document and file management subsystem of Admidio, specifically centered on the file processing logic handled by modules/documents-files.php. The root cause of the flaw is an authorization validation bypass stemming from a decoupled security check between folder-level permissions and file-level operations. When processing administrative or transactional requests within modules/documents-files.php, the application performs an initial authorization check at the entry point of the script. This preliminary check incorrectly evaluates upload rights against an attacker-supplied folder_uuid URL parameter rather than resolving and validating the rights against the actual parent folder associated with the targeted file. Subsequently, the internal file_delete handler executes its validation logic, but it strictly verifies whether the authenticated user possesses view or read rights on the file's genuine physical or logical location, completely omitting any secondary verification of upload rights against that specific destination directory. To exploit this vulnerability, an authenticated attacker with low-level privileges (such as upload rights to a scratch or personal folder) initiates a crafted HTTP request. The attacker populates the folder_uuid parameter with the universally unique identifier of the folder they legitimately own and possess upload rights to, satisfying the preliminary authorization check at the top of modules/documents-files.php. Concurrently, the attacker supplies the file_uuid parameter corresponding to a sensitive file located within a restricted folder where they hold exclusively view access. Because the authorization layer fails to correlate the file_uuid with its actual parent folder before enforcing write or delete permissions, the validation routine evaluates the request as authorized. The file_delete handler then processes the deletion request based on the flawed assumption that permissions are valid, resulting in the permanent removal of the restricted file. The affected versions include all Admidio installations prior to v5.0.10, serving as an ineffective patch implementation following the remediation attempt for GHSA-rmpj-3x5m-9m5f in v5.0.7, which remained exploitable through v5.0.9. Authentication is required to execute this attack, and the malicious actor must possess minimum privileges granting upload rights to at least one designated folder within the instance."
}