CVE-2026-32817

Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the documents and files module does not verify whether the current user has permission to delete folders or files. The folder_delete and file_delete action handlers in modules/documents-files.php only perform a VIEW authorization check (getFolderForDownload / getFileForDownload) before calling delete(), and they never validate a CSRF token. Because the target UUIDs are read from $_GET, deletion can be triggered by a plain HTTP GET request. When the module is in public mode (documents_files_module_enabled = 1) and a folder is marked public (fol_public = true), an unauthenticated attacker can permanently destroy the entire document library. Even when the module requires login, any user with view-only access can delete content they are only permitted to read. This issue has been fixed in version 5.0.7.

• CWE-862

• https://github.com/Admidio/admidio/security/advisories/GHSA-rmpj-3x5m-9m5fExploit, Mitigation, Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32811Heimdall is a cloud native Identity Aware Proxy and Access C…7.5
• CVE-2026-32812Admidio is an open-source user management solution. In versi…6.8
• CVE-2026-32813Admidio is an open-source user management solution. Versions…8
• CVE-2026-32814libheif is a HEIF and AVIF file format decoder and encoder. …6.5
• CVE-2026-32815SiYuan is a personal knowledge management system. In version…7.5
• CVE-2026-32816Admidio is an open-source user management solution. In versi…5.7
• CVE-2026-32818Admidio is an open-source user management solution. In versi…6.5
• CVE-2026-32819dataCycle is a data management system for centrally storing,…4.3
• CVE-2026-3282A flaw has been found in libvips 8.19.0. This vulnerability …7.1
• CVE-2026-32820dataCycle is a data management system for centrally storing,…7.5
• CVE-2026-32821dataCycle is a data management system for centrally storing,…8.1
• CVE-2026-32822dataCycle is a data management system for centrally storing,…6.1