# CVE-2026-47226: Admidio authorization bypass in file_delete handler

Source: https://junglewise.ai/threats/cve-2026-47226-admidio-authorization-bypass-in-file-delete-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-47226 · Severity: medium · CVSS 6.5 · Published 2026-05-29

Admidio, a popular web-based membership management system, contains a flaw that allows certain users to delete files they should only be able to view. An attacker with permission to upload files to any single folder can exploit this to permanently delete documents in other restricted folders. This can lead to significant data loss and the destruction of important organizational records.

Technologies: [Admidio](https://junglewise.ai/threats/technologies/admidio), [admidio/admidio (Packagist)](https://junglewise.ai/threats/technologies/admidio-admidio). Vendors: [Admidio](https://junglewise.ai/threats/vendors/admidio), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-47226 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47226 being exploited in the wild.

**How severe is CVE-2026-47226?** Medium severity, with a CVSS score of 6.5, published 29 May 2026.

**Which products and versions are affected?** Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.

**Is there a fix for CVE-2026-47226?** Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47226 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47226?** Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- admidio/admidio (Packagist): upgrade to 5.0.10 or later

  ```sh
  composer require admidio/admidio:^5.0.10
  ```


## Technical details

An authorization bypass exists in 'modules/documents-files.php' due to improper validation of the 'folder_uuid' parameter. The application performs a top-level check for upload rights using a user-supplied folder UUID rather than the actual parent folder of the file targeted for deletion. Furthermore, the 'file_delete' handler only verifies view permissions on the target file before executing the deletion. An attacker can provide a UUID for a folder they own to pass the initial check while specifying a target file UUID from a restricted folder, resulting in unauthorized file removal. This issue is an incomplete fix for a previous vulnerability and is addressed in version 5.0.10.

## Affected products

- Admidio Admidio <= 5.0.9

## Identifiers

- CVE-2026-47226
- GHSA-qc4c-hrmc-4f78

## Timeline

- 2026-05-25: disclosed
- 2026-05-29: advisory: GHSA-qc4c-hrmc-4f78 published

## References

- [https://api.github.com/users/VishaaLlKumaaRr](https://api.github.com/users/VishaaLlKumaaRr)
- [https://github.com/VishaaLlKumaaRr](https://github.com/VishaaLlKumaaRr)
- [https://api.github.com/users/VishaaLlKumaaRr/gists%7B/gist_id%7D](https://api.github.com/users/VishaaLlKumaaRr/gists%7B/gist_id%7D)
- [https://api.github.com/users/VishaaLlKumaaRr/repos](https://api.github.com/users/VishaaLlKumaaRr/repos)
- [https://avatars.githubusercontent.com/u/168093352?v=4](https://avatars.githubusercontent.com/u/168093352?v=4)
- [https://api.github.com/users/VishaaLlKumaaRr/events%7B/privacy%7D](https://api.github.com/users/VishaaLlKumaaRr/events%7B/privacy%7D)

## Related threats

- [Admidio improper access control in event registration](https://junglewise.ai/threats/cve-2026-117554-admidio-before-5-0-17-contains-an-improper-access-control)
- [Admidio information disclosure in RSS weblinks feed](https://junglewise.ai/threats/cve-2026-111916-admidio-before-5-0-16-contains-an-information-disclosure)
- [Admidio broken access control in inventory module](https://junglewise.ai/threats/cve-2026-111914-admidio-from-5-0-11-before-5-0-16-contains-a-broken-access)
- [Admidio authorization bypass via pdfl export mode](https://junglewise.ai/threats/cve-2026-111913-admidio-from-5-0-0-before-5-0-16-contains-an-authorization)
- [Admidio forum topic authorization bypass in ForumService::saveTopic()](https://junglewise.ai/threats/cve-2026-111912-admidio-from-5-0-0-before-5-0-16-contains-an-insecure-direct)