Most recent entries from all

EUVD-2026-351760

2026-10-06T22:14:52.387614+00:00

EUVD-2026-351760

fkie_cve-2026-47230

2026-10-06T22:14:52.387660+00:00

Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` mode `file_rename_save` shares the same root-cause shape as the cross-folder move bug (`05-documents-cross-folder-move-idor.md`): the top-level rights check at lines 79-89 validates `hasUploadRight()` on the URL parameter `folder_uuid`, but the rename operation acts on `file_uuid` — a separate URL parameter — without re-checking the folder that actually contains the file. `DocumentsService::renameFile()` resolves the target file via `getFileForDownload()` (which permits view-readable files) but does not require upload right on the file's source folder. Result: a user with upload right on any folder A can rename a file in folder B as long as they can view it. They can also overwrite the file's description. Version 5.0.10 contains a fix.

GHSA-q6w3-hpfv-rg36 — Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders

2026-10-06T22:14:52.387705+00:00

Affected: Packagist: admidio/admidio

## Summary

`modules/documents-files.php` mode `file_rename_save` shares the same root-cause shape as the cross-folder move bug (`05-documents-cross-folder-move-idor.md`): the top-level rights check at lines 79-89 validates `hasUploadRight()` on the URL parameter `folder_uuid`, but the rename operation acts on `file_uuid` — a separate URL parameter — without re-checking the folder that actually contains the file. `DocumentsService::renameFile()` resolves the target file via `getFileForDownload()` (which permits view-readable files) but does not require upload right on the file's source folder. Result: a user with upload right on any folder A can rename a file in folder B as long as they can view it. They can also overwrite the file's description.

## Details

### Vulnerable Code

`modules/documents-files.php:79-89` — top-level check binds to URL `folder_uuid`:

```php if ($getMode != 'list' && $getMode != 'download') { $folder = new Folder($gDb); $folder->getFolderForDownload($getFolderUUID); if (!$folder->hasUploadRight()) { $gMessage->show($gL10n->get('SYS_NO_RIGHTS')); } } ```

`src/Documents/Service/DocumentsService.php:272-315` — `renameFile()` resolves the file via `getFileForDownload()` (view-only) and never re-verifies upload right on the file's parent:

```php public function renameFile(string $fileUUID, string $newName, string $newDescription): array { $file = new File($this->db); $file->getFileForDownload($fileUUID);…