CVE-2026-47231 Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/documents-files.php gates state-changing modes by checking that the actor has hasUploadRight on the URL parameter folderuuid. The movesave handler then operates on a separate URL parameter fileuuid and calls...

CVE-2026-47231

Admidio is an open-source user management solution. Prior to version 5.0.10, "modules/documents-files.php" gates state-changing modes by checking that the actor has "hasUploadRight" on the URL parameter "folderuuid". The "movesave" handler then operates on a separate URL parameter "fileuuid" and...