CVE-2026-47231: Authorization Bypass Through User-Controlled Key

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/documents-files.php gates state-changing modes by checking that the actor has hasUploadRight on the URL parameter folderuuid. The movesave handler then operates on a separate URL parameter fileuuid and calls...