Description

Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` gates state-changing modes by checking that the actor has `hasUploadRight()` on the URL parameter `folder_uuid`. The `move_save` handler then operates on a *separate* URL parameter `file_uuid` and calls `File::moveToFolder($destFolderUUID)`. `File::moveToFolder()` checks the upload right on the destination folder but never on the source folder containing the file. As a result, any user who can upload to any single folder can move any file from any other folder — including private folders to which they have no view rights — into a folder they control, and then download it. Confidentiality is broken (private file contents leak) and integrity is broken (the file is removed from the original location). Version 5.0.10 contains a fix.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-12T14:17:54.210Z",
  "pubdate": "2026-08-12T14:17:54.210Z",
  "executiveSummary": "An authorization bypass vulnerability exists in Admidio prior to version 5.0.10, specifically within the file management component. The vulnerability arises due to improper access control validation during state-changing file operation requests.\nAn authenticated attacker with upload privileges to any single arbitrary folder can exploit this flaw to move sensitive files from restricted or private folders—to which they possess no read or view access—into a folder under their direct control. Successful exploitation results in severe confidentiality and integrity violations, as confidential file contents are exfiltrated via subsequent downloading, and files are destructively removed from their original locations.\nThe affected product is Admidio prior to version 5.0.10. The risk implications include complete loss of confidentiality and integrity for internal document repositories managed by the application. Attack requirements are minimal, necessitating only standard authentication and low-level privileges allowing file uploads to at least one legitimate directory within the system.",
  "technicalDetails": "The vulnerability resides in the file and document management subsystem of Admidio, specifically within the source file `modules/documents-files.php`. The application implements access controls for state-changing operations by verifying that the requesting actor satisfies the `hasUploadRight()` authorization check against the `folder_uuid` parameter supplied via the URL.\nThe flaw occurs within the `move_save` handler logic, which processes file relocation operations. While handling the request, the application operates on a distinct URL parameter designated as `file_uuid` and subsequently invokes the backend method `File::moveToFolder($destFolderUUID)`. During the execution of `File::moveToFolder()`, the underlying framework correctly validates whether the acting user possesses upload rights on the designated destination folder (`$destFolderUUID`). However, the implementation catastrophically fails to validate authorization constraints against the source folder or the specific source file identified by `file_uuid` prior to executing the move operation.\nConsequently, the step-by-step attack flow proceeds as follows: First, an authenticated attacker identifies or obtains the target `file_uuid` of a confidential document residing within a private folder. Second, the attacker formulates an HTTP request targeting `modules/documents-files.php` utilizing the `move_save` handler mode. Third, the attacker supplies a controlled destination folder via the `folder_uuid` parameter for which they possess legitimate upload rights, thereby successfully passing the superficial authorization check `hasUploadRight()`. Fourth, the attacker provides the target private file's identifier via the `file_uuid` parameter.\nUpon request processing, the application executes `File::moveToFolder()`, bypassing authorization checks on the origin context. The system relocates the file, severing it from its original private directory and placing it into the attacker-controlled folder. Finally, the attacker leverages standard download capabilities on the destination folder to retrieve the confidential file contents. This violates integrity by removing files from their original locations and breaks confidentiality by exposing private data to unauthorized principals."
}