---
id: CVE-2026-47231
title: Admidio is an open-source user management solution
summary: >-
  Admidio is an open-source user management solution. Prior to version 5.0.10,
  `modules/documents-files.php` gates state-changing modes by checking that the
  actor has `hasUploadRight()` on the URL parameter `folder_uuid`. The
  `move_save` h…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-639
  - CWE-863
published: '2026-08-12'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:55:04.493'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-47231'
references:
  - url: 'https://github.com/Admidio/admidio/security/advisories/GHSA-x628-457g-2pw9'
    label: security-advisories@github.com
  - url: 'https://github.com/Admidio/admidio/security/advisories/GHSA-x628-457g-2pw9'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00259
epssPercentile: 0.17853
ingestedAt: '2026-09-09T21:22:45.530Z'
---

## Overview

Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` gates state-changing modes by checking that the actor has `hasUploadRight()` on the URL parameter `folder_uuid`. The `move_save` handler then operates on a *separate* URL parameter `file_uuid` and calls `File::moveToFolder($destFolderUUID)`. `File::moveToFolder()` checks the upload right on the destination folder but never on the source folder containing the file. As a result, any user who can upload to any single folder can move any file from any other folder — including private folders to which they have no view rights — into a folder they control, and then download it. Confidentiality is broken (private file contents leak) and integrity is broken (the file is removed from the original location). Version 5.0.10 contains a fix.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.