Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-32817 is a critical vulnerability in the Admidio open-source user management solution, specifically in its documents and files module versions 5.0.0 through 5.0.6.'}, {'type': 'paragraph', 'content': "The vulnerability arises because the module's folder and file deletion handlers only check if a user has VIEW permissions before allowing deletion, instead of verifying if the user has proper upload or admin rights. Additionally, these handlers do not validate CSRF tokens and accept deletion requests via HTTP GET parameters."}, {'type': 'paragraph', 'content': 'This means that an unauthenticated attacker can delete public folders if the module is in public mode, and authenticated users with view-only access can delete files or folders they should only be able to read. The deletion is permanent and recursive, removing all subfolders and files from both the database and filesystem.'}, {'type': 'paragraph', 'content': 'The issue is due to missing authorization checks and lack of CSRF protection, allowing deletion through simple GET requests without proper validation.'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including:

• Permanent and irreversible deletion of documents and folders from the Admidio system.
• Privilege escalation where users with only view permissions can delete content.
• Unauthenticated attackers can delete entire public document libraries if the module is in public mode.
• Potential full organizational data loss if critical folders are deleted.
• No built-in recovery mechanism aside from restoring from backups.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by checking for unauthorized deletion requests targeting the Admidio documents and files module endpoints that use HTTP GET parameters for deletion actions.'}, {'type': 'paragraph', 'content': 'Specifically, monitoring HTTP GET requests to the deletion handlers (such as those including folder_uuid or file_uuid parameters) can reveal attempts to exploit the vulnerability.'}, {'type': 'paragraph', 'content': 'You can use network monitoring or web server logs to identify suspicious GET requests that trigger deletions without proper authorization.'}, {'type': 'list_item', 'content': 'Use tools like curl or wget to test if deletion endpoints accept GET requests without CSRF tokens, for example:'}, {'type': 'list_item', 'content': 'curl -v "http://your-admidio-site/path/modules/documents-files.php?action=folder_delete&folder_uuid=TARGET_UUID"'}, {'type': 'list_item', 'content': "Check web server access logs for GET requests containing 'folder_delete' or 'file_delete' actions with UUID parameters."}, {'type': 'list_item', 'content': 'Monitor for unexpected deletions or missing documents/folders that could indicate exploitation.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation steps include:

• Upgrade Admidio to version 5.0.7 or later, where this vulnerability has been fixed.
• If upgrading is not immediately possible, restrict access to the documents and files module endpoints to trusted users only, for example by IP whitelisting or network segmentation.
• Disable the documents_files_module or set it to a mode that limits public access (avoid public mode with documents_files_module_enabled = 1).
• Monitor and block HTTP GET requests attempting to delete folders or files by filtering requests with folder_delete or file_delete actions.
• Educate users about the risk of CSRF attacks and advise them not to visit untrusted websites while logged into Admidio.

Useful 0 Not Useful 0