CVE-2026-32817 Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
Attackers can delete documents and folders without proper authorization or CSRF protection, potentially destroying data in Admidio.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32817?
CVE-2026-32817 is a critical missing authorization vulnerability in admidio, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the documents and files module does not verify whether the current user has permission to delete folders or files. The folder_delete and file_delete action handlers in modules/documents-files.php only perform a VIEW authorization check (getFolderForDownload / getFileForDownload) before calling delete(), and they never validate a CSRF token. Because the target UUIDs are read from $_GET, deletion can be triggered by a plain HTTP GET request. When the module is in public mode (documents_files_module_enabled = 1) and a folder is marked public (fol_public = true), an unauthenticated attacker can permanently destroy the entire document library. Even when the module requires login, any user with view-only access can delete content they are only permitted to read. This issue has been fixed in version 5.0.7.
Weakness: CWE-862
Which versions are affected by CVE-2026-32817?
2 open source packages ship an affected version, including admidio/admidio. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
admidio/admidio Packagist | From 5.0.0 | 5.0.7 |
admidio/admidio Packagist | From 5.0.0 | 5.0.7 |
Products include Admidio Admidio.
How do I fix CVE-2026-32817?
Upgrade admidio/admidio to 5.0.7 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-32817 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32817 exists.
Other vulnerabilities in admidio
- CVE-2024-37906 Admidio has Blind SQL Injection in ecard_send.php
- CVE-2021-32630 Various
- CVE-2024-38529 Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment
- CVE-2026-32756 Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module
- CVE-2021-43810 Cross-site Scripting (XSS) when redirect an url
Sources
Also known as GHSA-rmpj-3x5m-9m5f.