Is CVE-2026-47230 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47230 being exploited in the wild.

How severe is CVE-2026-47230?

Medium severity, with a CVSS score of 6.5, published 29 May 2026.

Which products and versions are affected?

Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.

Is there a fix for CVE-2026-47230?

Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47230 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-47230?

Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47230: Admidio IDOR in documents-files.php allows unauthorized file renaming

Q: Which products and versions are affected?

Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.

Q: Is there a fix for CVE-2026-47230?

Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47230 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-47230?

Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47230 · Severity: medium · CVSS 6.5 · Published 2026-05-29

Admidio is a web-based membership management system. A vulnerability in its document management module allows any user with permission to upload files to at least one folder to rename files and change descriptions in any other folder they can view. This could be used to deface public announcements, misrepresent official policies, or trick other users by changing file names to misleading titles.

Technologies: Admidio, admidio/admidio (Packagist). Vendors: Admidio, Packagist.

Quick answers

Is CVE-2026-47230 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47230 being exploited in the wild.
How severe is CVE-2026-47230?: Medium severity, with a CVSS score of 6.5, published 29 May 2026.
Which products and versions are affected?: Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.
Is there a fix for CVE-2026-47230?: Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47230 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47230?: Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

admidio/admidio (Packagist): upgrade to 5.0.10 or later
```
composer require admidio/admidio:^5.0.10
```

Technical details

An Insecure Direct Object Reference (IDOR) exists in `modules/documents-files.php` due to improper authorization binding. The application validates that a user has `hasUploadRight()` on a `folder_uuid` provided in the URL, but then performs a rename operation on a `file_uuid` without verifying if the user has upload rights for that specific file's parent folder. The `DocumentsService::renameFile()` method only requires the user to have download (view) rights on the target file to modify its metadata. An attacker with low-level upload privileges can exploit this by providing a folder UUID they control alongside a target file UUID they wish to modify. This results in unauthorized integrity changes to file names and descriptions across folder boundaries.

Affected products

Admidio Admidio <= 5.0.9

Identifiers

CVE-2026-47230
GHSA-q6w3-hpfv-rg36

Timeline

2026-05-25: advisory: GitHub Advisory published
2026-05-29: disclosed
5.0.10: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.