CVE-2026-47230

Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` mode `file_rename_save` shares the same root-cause shape as the cross-folder move bug (`05-documents-cross-folder-move-idor.md`): the top-level rights check at lines 79-89 validates `hasUploadRight()` on the URL parameter `folder_uuid`, but the rename operation acts on `file_uuid` — a separate URL parameter — without re-checking the folder that actually contains the file. `DocumentsService::renameFile()` resolves the target file via `getFileForDownload()` (which permits view-readable files) but does not require upload right on the file's source folder. Result: a user with upload right on any folder A can rename a file in folder B as long as they can view it. They can also overwrite the file's description. Version 5.0.10 contains a fix.

• CWE-639
• CWE-863

• https://github.com/Admidio/admidio/security/advisories/GHSA-q6w3-hpfv-rg36

Published

Aug 12, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47225Typesense is a fast, typo-tolerant search engine. Prior to v…6
• CVE-2026-47226Admidio is an open-source user management solution. Prior to…6.5
• CVE-2026-47227Admidio is an open-source user management solution. `modules…6.5
• CVE-2026-47228Admidio is an open-source user management solution. `modules…5.2
• CVE-2026-47229Admidio is an open-source user management solution. Prior to…5.4
• CVE-2026-4723Use-after-free in the JavaScript Engine component. This vuln…9.8
• CVE-2026-47231Admidio is an open-source user management solution. Prior to…8.1
• CVE-2026-47232Admidio is an open-source user management solution. Prior to…4.3
• CVE-2026-47233Admidio is an open-source user management solution. Version …6.5
• CVE-2026-47234Admidio is an open-source user management solution. Prior to…4.4
• CVE-2026-47236Solidtime is an open-source time-tracking app. Prior to vers…4.3
• CVE-2026-47237Kubeflow Community Distribution helps users to install Kubef…8