# CVE-2026-47230: Admidio IDOR in documents-files.php allows unauthorized file renaming

Source: https://junglewise.ai/threats/cve-2026-47230-admidio-idor-in-documents-files-php-allows-unauthorized-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-47230 · Severity: medium · CVSS 6.5 · Published 2026-05-29

Admidio is a web-based membership management system. A vulnerability in its document management module allows any user with permission to upload files to at least one folder to rename files and change descriptions in any other folder they can view. This could be used to deface public announcements, misrepresent official policies, or trick other users by changing file names to misleading titles.

Technologies: [Admidio](https://junglewise.ai/threats/technologies/admidio), [admidio/admidio (Packagist)](https://junglewise.ai/threats/technologies/admidio-admidio). Vendors: [Admidio](https://junglewise.ai/threats/vendors/admidio), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-47230 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47230 being exploited in the wild.

**How severe is CVE-2026-47230?** Medium severity, with a CVSS score of 6.5, published 29 May 2026.

**Which products and versions are affected?** Admidio <= 5.0.9; admidio/admidio (Packagist) <= 5.0.9, ECOSYSTEM:introduced=0,fixed=5.0.10.

**Is there a fix for CVE-2026-47230?** Yes. admidio/admidio (Packagist): upgrade to 5.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47230 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47230?** Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- admidio/admidio (Packagist): upgrade to 5.0.10 or later

  ```sh
  composer require admidio/admidio:^5.0.10
  ```


## Technical details

An Insecure Direct Object Reference (IDOR) exists in `modules/documents-files.php` due to improper authorization binding. The application validates that a user has `hasUploadRight()` on a `folder_uuid` provided in the URL, but then performs a rename operation on a `file_uuid` without verifying if the user has upload rights for that specific file's parent folder. The `DocumentsService::renameFile()` method only requires the user to have download (view) rights on the target file to modify its metadata. An attacker with low-level upload privileges can exploit this by providing a folder UUID they control alongside a target file UUID they wish to modify. This results in unauthorized integrity changes to file names and descriptions across folder boundaries.

## Affected products

- Admidio Admidio <= 5.0.9

## Identifiers

- CVE-2026-47230
- GHSA-q6w3-hpfv-rg36

## Timeline

- 2026-05-25: advisory: GitHub Advisory published
- 2026-05-29: disclosed
- 5.0.10: patched

## References

- [https://api.github.com/users/offset](https://api.github.com/users/offset)
- [https://github.com/offset](https://github.com/offset)
- [https://api.github.com/users/offset/gists%7B/gist_id%7D](https://api.github.com/users/offset/gists%7B/gist_id%7D)
- [https://api.github.com/users/offset/repos](https://api.github.com/users/offset/repos)
- [https://avatars.githubusercontent.com/u/114768995?v=4](https://avatars.githubusercontent.com/u/114768995?v=4)
- [https://api.github.com/users/offset/events%7B/privacy%7D](https://api.github.com/users/offset/events%7B/privacy%7D)

## Related threats

- [Admidio improper access control in event registration](https://junglewise.ai/threats/cve-2026-117554-admidio-before-5-0-17-contains-an-improper-access-control)
- [Admidio information disclosure in RSS weblinks feed](https://junglewise.ai/threats/cve-2026-111916-admidio-before-5-0-16-contains-an-information-disclosure)
- [Admidio broken access control in inventory module](https://junglewise.ai/threats/cve-2026-111914-admidio-from-5-0-11-before-5-0-16-contains-a-broken-access)
- [Admidio authorization bypass via pdfl export mode](https://junglewise.ai/threats/cve-2026-111913-admidio-from-5-0-0-before-5-0-16-contains-an-authorization)
- [Admidio forum topic authorization bypass in ForumService::saveTopic()](https://junglewise.ai/threats/cve-2026-111912-admidio-from-5-0-0-before-5-0-16-contains-an-insecure-direct)