CVE-2026-47230: Admidio Auth Bypass Vulnerability

CVE-2026-47230 Overview

CVE-2026-47230 is a broken access control vulnerability in Admidio, an open-source user management solution. The flaw affects modules/documents-files.php in the file_rename_save mode prior to version 5.0.10. The top-level rights check validates hasUploadRight() against the folder_uuid URL parameter, but the rename operation acts on a separate file_uuid parameter without re-verifying permissions on the folder that actually contains the target file. This mismatch is an Insecure Direct Object Reference [CWE-639].

Critical Impact
An authenticated user with upload rights on any folder can rename or overwrite the description of any file they can view in a different folder, breaking integrity boundaries between document folders.

Affected Products

Admidio versions prior to 5.0.10
modules/documents-files.php component (file_rename_save mode)
DocumentsService::renameFile() server-side function

Discovery Timeline

2026-08-12 - CVE-2026-47230 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-47230

Vulnerability Analysis

The vulnerability is a variant of a previously documented cross-folder move Insecure Direct Object Reference (IDOR) in Admidio. The file_rename_save handler in modules/documents-files.php enforces access control at lines 79-89 by calling hasUploadRight() on the folder_uuid URL parameter. However, the rename operation itself operates on a file_uuid parameter passed independently in the request.

Because the two parameters are never cross-validated, the server trusts the folder identifier for authorization while acting on the file identifier for the state change. The result is a horizontal privilege escalation across folder boundaries within the documents module.

Root Cause

The root cause is missing authorization on the object actually being modified. DocumentsService::renameFile() resolves the target file through getFileForDownload(), which permits any view-readable file to be returned. It does not verify that the caller holds upload rights on the source folder containing that file. Authorization was designed around folders, but the mutation is performed on a file whose true parent folder is never re-checked.

Attack Vector

An authenticated attacker needs upload rights on at least one folder (folder A) and view access on a file in a different folder (folder B). The attacker submits a request to documents-files.php in file_rename_save mode, supplying the folder_uuid of folder A alongside a file_uuid belonging to folder B.

The top-level check passes because the attacker legitimately has upload rights on folder A. The rename then executes against the file in folder B, allowing the attacker to change its name and overwrite its description. This can be used to disrupt document workflows, mislead users, or tamper with organizational records.

The vulnerability manifests in the request handler and service layer of the documents module. See the GitHub Security Advisory for technical details on the affected code paths.

Detection Methods for CVE-2026-47230

Indicators of Compromise

Unexpected renames of documents in folders where the acting user does not hold upload rights.
Modified file descriptions on documents whose owning folder is outside the acting user's upload scope.
HTTP POST requests to modules/documents-files.php with mode=file_rename_save where the submitted folder_uuid does not match the file's actual parent folder.

Detection Strategies

Correlate application audit logs of document renames with the user's effective folder permissions to surface cross-folder mutations.
Instrument DocumentsService::renameFile() or add web server logging to capture both folder_uuid and file_uuid for each request and flag mismatches.
Baseline normal rename activity per user and alert on spikes or renames of files outside their assigned folders.

Monitoring Recommendations

Enable and centralize Admidio access logs, and ingest them into a SIEM for retention and correlation.
Alert on any file_rename_save requests originating from low-privileged accounts targeting files in sensitive folders.
Review document history and change logs periodically for unexplained rename or description edits.

How to Mitigate CVE-2026-47230

Immediate Actions Required

Upgrade Admidio to version 5.0.10 or later, which contains the fix.
Audit recent document rename and description-change events for unauthorized activity prior to patching.
Review and tighten folder-level upload rights so that users hold the minimum permissions required.

Patch Information

Admidio version 5.0.10 remediates the flaw by enforcing upload rights against the folder that actually contains the target file, rather than trusting the client-supplied folder_uuid. Full details are available in the Admidio GitHub Security Advisory GHSA-q6w3-hpfv-rg36.

Workarounds

If immediate patching is not possible, restrict upload rights to trusted users only to reduce the population of accounts capable of triggering the flaw.
Temporarily disable the documents and files module for non-administrative users until the upgrade is applied.
Place Admidio behind a web application firewall rule that logs and inspects requests to modules/documents-files.php for anomalous folder_uuid and file_uuid combinations.

bash

# Upgrade Admidio to the patched release
cd /path/to/admidio
git fetch --tags
git checkout v5.0.10
# Follow the official upgrade procedure and run database migrations
php adm_program/installation/update.php