CVE-2026-47226 Overview
CVE-2026-47226 is a broken access control vulnerability in Admidio, an open-source user management solution. The flaw allows an authenticated member with upload rights on any folder to permanently delete files from folders where they only hold view access. The vulnerability exists in modules/documents-files.php, where the authorization check trusts the attacker-supplied folder_uuid parameter rather than the file's actual parent folder. This issue is an incomplete fix of GHSA-rmpj-3x5m-9m5f, which was patched in v5.0.7 but remains exploitable in v5.0.9. The vulnerability is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Authenticated Admidio members can permanently delete files from restricted folders by supplying a folder they own in the folder_uuid parameter while targeting a file in another folder via file_uuid.
Affected Products
- Admidio versions prior to 5.0.10
- Admidio v5.0.9 (confirmed exploitable)
- Admidio v5.0.7 and v5.0.8 (incomplete fix from GHSA-rmpj-3x5m-9m5f)
Discovery Timeline
- 2026-08-12 - CVE-2026-47226 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-47226
Vulnerability Analysis
The vulnerability affects the document management module of Admidio. The authorization logic at the top of modules/documents-files.php performs its upload-rights check against the folder_uuid value supplied in the URL. This value is attacker-controlled and never validated against the actual parent folder of the target file.
Downstream, the file_delete handler verifies only view rights on the file's true parent folder. It never re-checks upload rights against that real location. The combination lets an attacker satisfy both checks with mismatched inputs.
Because the file deletion is permanent, exploitation results in loss of data integrity across restricted document folders. Any authenticated member with upload permission on a single folder becomes capable of destroying files across the platform.
Root Cause
The root cause is authorization bypass through a user-controlled key [CWE-639]. The application uses two separate identifiers, folder_uuid and file_uuid, but does not enforce that they refer to the same folder. This trust in unvalidated input breaks the access control model for document deletion.
Attack Vector
Exploitation requires an authenticated Admidio account with upload rights on at least one folder. The attacker sends a request to the documents-files endpoint with folder_uuid set to a folder they legitimately control and file_uuid set to a file in a restricted folder. The upload-rights check passes against the attacker's folder, and the delete handler proceeds because view access on the target file is granted. See the Admidio security advisory GHSA-qc4c-hrmc-4f78 for technical details.
Detection Methods for CVE-2026-47226
Indicators of Compromise
- HTTP requests to modules/documents-files.php where folder_uuid and the parent folder of the referenced file_uuid do not match.
- Unexpected deletion entries in Admidio audit logs referencing files from folders the acting user does not have upload rights to.
- Sudden disappearance of files from restricted document folders reported by legitimate users.
Detection Strategies
- Review web server access logs for requests to the documents module containing mismatched folder_uuid and file_uuid parameters.
- Correlate Admidio user role assignments with file deletion events to flag deletions performed by users without upload rights on the target folder.
- Monitor for repeated deletion requests from a single authenticated session across multiple folder identifiers.
Monitoring Recommendations
- Enable verbose logging on the Admidio documents module and forward events to a central log platform for correlation.
- Alert on any file deletion event where the actor lacks upload permission on the file's parent folder.
- Baseline normal deletion volumes per user and alert on statistical outliers.
How to Mitigate CVE-2026-47226
Immediate Actions Required
- Upgrade all Admidio instances to version 5.0.10 or later, which contains the corrected authorization check.
- Audit recent file deletion activity in the documents module for unauthorized removals since deploying v5.0.7 through v5.0.9.
- Restore deleted files from backup where unauthorized deletions are identified.
Patch Information
Admidio version 5.0.10 addresses CVE-2026-47226 by validating that the folder_uuid parameter corresponds to the actual parent folder of the file referenced by file_uuid, and by verifying upload rights against that real location. Refer to the GHSA-qc4c-hrmc-4f78 advisory for the official patch guidance.
Workarounds
- Revoke upload rights from untrusted or low-privilege members until the upgrade is completed.
- Restrict access to the Admidio instance to trusted networks using web server access controls while patching is in progress.
- Increase backup frequency for document folders to reduce impact from unauthorized deletions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
