Is CVE-2026-47226 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47226 being exploited in the wild.

How severe is CVE-2026-47226?

Medium severity, with a CVSS score of 6.5, published 29 May 2026.

Which products and versions are affected?

Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.

Is there a fix for CVE-2026-47226?

Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47226 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-47226?

Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47226: Admidio authorization bypass in file_delete handler

Q: Which products and versions are affected?

Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.

Q: Is there a fix for CVE-2026-47226?

Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47226 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-47226?

Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47226 · Severity: medium · CVSS 6.5 · Published 2026-05-29

Admidio, a popular web-based membership management system, contains a flaw that allows certain users to delete files they should only be able to view. An attacker with permission to upload files to any single folder can exploit this to permanently delete documents in other restricted folders. This can lead to significant data loss and the destruction of important organizational records.

Technologies: Admidio, admidio/admidio (Packagist). Vendors: Admidio, Packagist.

Quick answers

Is CVE-2026-47226 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47226 being exploited in the wild.
How severe is CVE-2026-47226?: Medium severity, with a CVSS score of 6.5, published 29 May 2026.
Which products and versions are affected?: Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.
Is there a fix for CVE-2026-47226?: Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47226 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47226?: Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

admidio/admidio (Packagist): upgrade to 5.0.10 or later
```
composer require admidio/admidio:^5.0.10
```

Technical details

An authorization bypass exists in 'modules/documents-files.php' due to improper validation of the 'folder_uuid' parameter. The application performs a top-level check for upload rights using a user-supplied folder UUID rather than the actual parent folder of the file targeted for deletion. Furthermore, the 'file_delete' handler only verifies view permissions on the target file before executing the deletion. An attacker can provide a UUID for a folder they own to pass the initial check while specifying a target file UUID from a restricted folder, resulting in unauthorized file removal. This issue is an incomplete fix for a previous vulnerability and is addressed in version 5.0.10.

Affected products

Admidio Admidio <= 5.0.9

Identifiers

CVE-2026-47226
GHSA-qc4c-hrmc-4f78

Timeline

2026-05-25: disclosed
2026-05-29: advisory: GHSA-qc4c-hrmc-4f78 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.