Executive brief
Admidio is a web-based membership management system. A vulnerability in its document management module allows any user with permission to upload files to at least one folder to rename files and change descriptions in any other folder they can view. This could be used to deface public announcements, misrepresent official policies, or trick other users by changing file names to misleading titles.
Technical details
An Insecure Direct Object Reference (IDOR) exists in `modules/documents-files.php` due to improper authorization binding. The application validates that a user has `hasUploadRight()` on a `folder_uuid` provided in the URL, but then performs a rename operation on a `file_uuid` without verifying if the user has upload rights for that specific file's parent folder. The `DocumentsService::renameFile()` method only requires the user to have download (view) rights on the target file to modify its metadata. An attacker with low-level upload privileges can exploit this by providing a folder UUID they control alongside a target file UUID they wish to modify. This results in unauthorized integrity changes to file names and descriptions across folder boundaries.
Affected products
- Admidio Admidio <= 5.0.9
Timeline
- 2026-05-25: advisory: GitHub Advisory published
- 2026-05-29: disclosed
- 5.0.10: patched