CVE-2026-47230 PUBLISHED

Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders

Assigner: GitHub_M
Reserved: 18.05.2026 Published: 12.08.2026 Updated: 12.08.2026

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/documents-files.php mode file_rename_save shares the same root-cause shape as the cross-folder move bug (05-documents-cross-folder-move-idor.md): the top-level rights check at lines 79-89 validates hasUploadRight() on the URL parameter folder_uuid, but the rename operation acts on file_uuid — a separate URL parameter — without re-checking the folder that actually contains the file. DocumentsService::renameFile() resolves the target file via getFileForDownload() (which permits view-readable files) but does not require upload right on the file's source folder. Result: a user with upload right on any folder A can rename a file in folder B as long as they can view it. They can also overwrite the file's description. Version 5.0.10 contains a fix.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS Score: 6.5

Product Status

Vendor Admidio
Product admidio
Versions
  • Version < 5.0.10 is affected

References

Problem Types

  • CWE-639: Authorization Bypass Through User-Controlled Key CWE
  • CWE-863: Incorrect Authorization CWE