CVE-2026-47231
Received Received - Intake

Unauthorized File Movement in Admidio Leading to Data Exposure

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description
Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` gates state-changing modes by checking that the actor has `hasUploadRight()` on the URL parameter `folder_uuid`. The `move_save` handler then operates on a *separate* URL parameter `file_uuid` and calls `File::moveToFolder($destFolderUUID)`. `File::moveToFolder()` checks the upload right on the destination folder but never on the source folder containing the file. As a result, any user who can upload to any single folder can move any file from any other folder — including private folders to which they have no view rights — into a folder they control, and then download it. Confidentiality is broken (private file contents leak) and integrity is broken (the file is removed from the original location). Version 5.0.10 contains a fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-47231
EUVD
EUVD-2026-57208

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
admidio admidio 5.0.10
admidio admidio to 5.0.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-47231 is an Insecure Direct Object Reference (IDOR) vulnerability in Admidio versions 5.0.9 and earlier. It allows users with upload rights to a single folder to move files from private folders they cannot access into their own folders and download them. The flaw occurs because the system checks upload rights only for the destination folder during file movement but ignores the source folder's permissions.

Detection Guidance

To detect this vulnerability, inspect the Admidio application version. Check if the version is 5.0.9 or earlier. Review file movement logs in modules/documents-files.php for suspicious activity where users move files between folders without proper permissions. Look for mismatched folder and file UUIDs in requests.

Impact Analysis

This vulnerability can lead to unauthorized access to private files, breaking confidentiality. Attackers can move sensitive files from restricted folders to locations they control, then download them. It also compromises data integrity by removing files from their original locations. Exploitation requires only basic upload rights, making it accessible to low-privilege users.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection regulations like GDPR and HIPAA by enabling unauthorized access to sensitive data. It compromises confidentiality and integrity controls, which are critical for maintaining compliance with these standards.

Mitigation Strategies

Immediately upgrade Admidio to version 5.0.10 or later to patch the vulnerability. Review and restrict user permissions, ensuring only necessary upload rights are granted. Monitor file movement operations for unauthorized activity and audit folder access logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47231. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart