CVE-2026-47231: Admidio Information Disclosure Flaw

CVE-2026-47231 Overview

CVE-2026-47231 is a broken access control vulnerability in Admidio, an open-source user management solution. The flaw resides in modules/documents-files.php and allows any authenticated user with upload rights to a single folder to move arbitrary files from other folders, including private folders, into a folder they control. Once moved, the attacker can download the file. The vulnerability breaks both confidentiality, by leaking private file contents, and integrity, by removing files from their original location. Admidio version 5.0.10 contains the fix.

Critical Impact
Authenticated users with upload rights to any folder can exfiltrate and relocate files from private folders they have no permission to view.

Affected Products

Admidio versions prior to 5.0.10
modules/documents-files.phpmove_save handler
Deployments exposing document management to low-privileged users

Discovery Timeline

2026-08-12 - CVE-2026-47231 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-47231

Vulnerability Analysis

The vulnerability is a broken access control issue classified as [CWE-639] Authorization Bypass Through User-Controlled Key. Admidio's modules/documents-files.php gates state-changing operations by verifying hasUploadRight() against the URL parameter folder_uuid. However, the move_save handler executes against a separate URL parameter, file_uuid, and invokes File::moveToFolder($destFolderUUID).

The File::moveToFolder() method only validates upload rights on the destination folder. It never validates that the caller has read or write access to the source folder that contains the file being moved. This mismatch between the gate check and the operational target allows an attacker to reference any file_uuid in the system.

An authenticated attacker with upload rights in a single folder can move any file from any other folder, including private folders, into a folder they control. They can then download the file through normal document access flows. The result is confidentiality loss for private content and integrity loss because the file is removed from its original location.

Root Cause

The root cause is inconsistent authorization scoping between the request gate and the underlying operation. The permission check operates on folder_uuid while the move operation acts on file_uuid. No authorization check is performed on the source folder that owns the target file.

Attack Vector

Exploitation requires an authenticated account with upload rights to at least one folder in the Admidio documents module. The attacker crafts a move_save request containing a folder_uuid they control and a file_uuid referencing a file in a restricted folder. See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-47231

Indicators of Compromise

Unexpected file relocations in the Admidio documents module where the source folder differs from folders the acting user typically accesses
Access log entries showing move_save mode requests to modules/documents-files.php with file_uuid values not previously associated with the requesting user
Downloads immediately following move operations targeting files that originated in restricted folders

Detection Strategies

Review web server access logs for POST or GET requests to modules/documents-files.php containing mode=move_save parameters
Correlate file_uuid movements against the source folder's access control list to identify moves crossing permission boundaries
Alert on any user account performing move operations at a rate inconsistent with their typical activity baseline

Monitoring Recommendations

Enable verbose application logging within Admidio to capture file movement events with user, source folder, and destination folder attributes
Monitor filesystem changes within the Admidio adm_my_files directory for files moving between folders with divergent permission sets
Track download events that occur within short time windows following move operations

How to Mitigate CVE-2026-47231

Immediate Actions Required

Upgrade all Admidio installations to version 5.0.10 or later without delay
Audit document folder permissions and reduce the number of users with upload rights to the minimum required
Review recent move and download activity for signs of unauthorized file relocation

Patch Information

Admidio version 5.0.10 contains the fix. The maintainers published a GitHub Security Advisory with remediation guidance. Administrators should apply the upgrade following standard Admidio update procedures and verify functionality of the documents module after patching.

Workarounds

Temporarily revoke upload rights from non-administrative users on the documents module until patching completes
Restrict access to modules/documents-files.php at the web server or reverse proxy layer to trusted administrator IP ranges
Isolate sensitive documents outside the Admidio documents module until the upgrade is verified

bash

# Example: block documents-files.php move_save mode at nginx until patched
location ~ /modules/documents-files\.php$ {
    if ($arg_mode = "move_save") { return 403; }
}