CVE-2026-47226 Admidio CVE debrief

Who should care

Defenders responsible for Admidio installations, security teams, and IT administrators should be aware of this vulnerability and take necessary actions to address it. They should prioritize upgrading to version 5.0.10 and review and restrict upload rights for Admidio members. Additionally, defenders need to verify the affected versions and ensure that the patch is applied to prevent exploitation. The vulnerability requires verification of upload rights and

Why it matters

CVE-2026-47226 is a vulnerability in Admidio that allows an authenticated member with upload rights to permanently delete files from folders where they have only view access. Defenders should prioritize upgrading to version 5.0.10 and review and restrict upload rights for Admidio members.

• An attacker can permanently delete files from folders where they have only view access, potentially leading to data loss.
• The vulnerability can be exploited by an authenticated Admidio member with upload rights on any one folder.
• Defenders need to verify the affected versions and ensure that the patch is applied to prevent exploitation.
• The vulnerability requires verification of upload rights and file access controls to prevent unauthorized file deletion.

Technical summary

The vulnerability is caused by an incomplete authorization check in the `modules/documents-files.php` file, which allows attackers to bypass upload-right checks and delete files. An authenticated Admidio member with upload rights on any one folder can permanently delete files from folders where they have only view access. This issue arises because the authorization check at the top of `modules/documents-files.php` evaluates upload rights against the attacker-supplied `folder_uuid` URL parameter — not the file's actual parent folder. The `file_delete` handler then only verifies view rights on the file's real location, never upload rights. By passing a folder they legitimately own in `folder_uuid` while targeting

Defensive priority

Defenders should prioritize upgrading to version 5.0.10 to address the vulnerability. They should also review and restrict upload rights for Admidio members, monitor file deletion activities, and implement compensating controls to detect and prevent unauthorized file access.

Recommended defensive actions

• Upgrade to Admidio version 5.0.10
• Review and restrict upload rights for Admidio members
• Monitor file deletion activities
• Implement compensating controls to detect and prevent unauthorized file access
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is described in the CVE record and the Admidio security advisories. The issue is caused by an incomplete authorization check in the `modules/documents-files.php` file, which allows attackers to bypass upload-right checks and delete files.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.