Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges (CVE-2026-47226) | HOL Guard CVE

Medium · CVSS 6.5CVE-2026-47226GHSA-QC4C-HRMC-4F78

Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges

Answer in brief

CVE-2026-47226 records a Medium severity (CVSS 6.5) vulnerability in Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges. The current sources do not mark it as known exploited. The current feed maps admidio/admidio (composer), Admidio/admidio (generic), admidio/admidio (packagist). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Aug 12, 2026Updated Sep 9, 2026Source checked Sep 17, 2026First seen by HOL Jun 11, 2026Material review Sep 9, 2026

Upstream Advisory

Key facts

Risk: Medium · CVSS 6.5
Exploitation: Not marked as known exploited
Affected software: 3 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps admidio/admidio (composer), Admidio/admidio (generic), admidio/admidio (packagist). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
admidio/admidiocomposer	<=5.0.9	5.0.10
Admidio/admidiogeneric	< 5.0.10	Not reported
admidio/admidiopackagist	>=0 <5.0.10	5.0.10

Recommended response

Check inventory. Check lockfiles and deployed manifests for admidio/admidio, Admidio/admidio, admidio/admidio.
Review the reported fix. Update admidio/admidio to 5.0.10; admidio/admidio to 5.0.10 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Aug 12, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 9, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Jun 11, 2026

Sources and claim methodology

Upstream source description

Admidio is an open-source user management solution. Prior to version 5.0.10, an authenticated Admidio member with upload rights on any one folder can permanently delete files from folders where they have only view access. The authorization check at the top of `modules/documents-files.php` evaluates upload rights against the attacker-supplied `folder_uuid` URL parameter — not the file's actual parent folder. The `file_delete` handler then only verifies view rights on the file's real location, never upload rights. By passing a folder they legitimately own in `folder_uuid` while targeting a file in a restricted folder via `file_uuid`, an attacker bypasses the upload-right check entirely and permanently deletes the file. This is an incomplete fix of GHSA-rmpj-3x5m-9m5f, which was patched in v5.0.7 but remains exploitable in v5.0.9. User should upgrade to v5.0.10 to receive an updated fix.

Quoted source text, attributed separately from HOL analysis.