Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion

Vulnerability

Overview

CVE-2026-32817 is a missing authorization and CSRF protection vulnerability in the documents and files module of Admidio, an open-source user management system. In versions 5.0.0 through 5.0.6, the folder_delete and file_delete action handlers in modules/documents-files.php only perform a VIEW authorization check (getFolderForDownload / getFileForDownload) before calling the delete() method, and they never validate a CSRF token [1][2]. The target UUIDs are read directly from $_GET, meaning deletion can be triggered by a plain HTTP GET request without any additional authentication or token [1].

Attack

Surface and Exploitation

The module's access check only blocks unauthenticated users when the setting documents_files_module_enabled is set to 2 (members-only). When the setting is 1 (public), no login is required to reach any action handler [1]. If a folder is marked as public (fol_public = true), an unauthenticated attacker can permanently destroy the entire document library by sending a crafted GET request to the vulnerable endpoint. Even when the module requires login, any authenticated user with view-only access can delete content they are only permitted to read [1][2].，2].

Impact

An attacker exploiting this vulnerability can permanently delete all files and folders in the document library, leading to complete data loss of stored documents. No special privileges beyond view access (or no authentication at all in public mode) are required, making this a high-severity issue that can be exploited remotely without user interaction [1][2].

Mitigation

The issue has been fixed in Admidio version 5.0.7 [1][2]. Users running versions 5.0.0 through 5.0.6 should upgrade immediately to 5.0.7 or later. No workarounds are documented; the fix adds proper authorization checks and CSRF token validation to the delete handlers [1].