Executive brief
Admidio, a popular web-based membership management system, contains a flaw that allows certain users to delete files they should only be able to view. An attacker with permission to upload files to any single folder can exploit this to permanently delete documents in other restricted folders. This can lead to significant data loss and the destruction of important organizational records.
Technical details
An authorization bypass exists in 'modules/documents-files.php' due to improper validation of the 'folder_uuid' parameter. The application performs a top-level check for upload rights using a user-supplied folder UUID rather than the actual parent folder of the file targeted for deletion. Furthermore, the 'file_delete' handler only verifies view permissions on the target file before executing the deletion. An attacker can provide a UUID for a folder they own to pass the initial check while specifying a target file UUID from a restricted folder, resulting in unauthorized file removal. This issue is an incomplete fix for a previous vulnerability and is addressed in version 5.0.10.
Affected products
- Admidio Admidio <= 5.0.9
Timeline
- 2026-05-25: disclosed
- 2026-05-29: advisory: GHSA-qc4c-hrmc-4f78 published
References
- https://api.github.com/users/VishaaLlKumaaRr
- https://github.com/VishaaLlKumaaRr
- https://api.github.com/users/VishaaLlKumaaRr/gists%7B/gist_id%7D
- https://api.github.com/users/VishaaLlKumaaRr/repos
- https://avatars.githubusercontent.com/u/168093352?v=4
- https://api.github.com/users/VishaaLlKumaaRr/events%7B/privacy%7D