CVE-2026-32817: Admidio broken access control (CVSS 9.1)

Description

Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the documents and files module does not verify whether the current user has permission to delete folders or files. The folder_delete and file_delete action handlers in modules/documents-files.php only perform a VIEW authorization check (getFolderForDownload / getFileForDownload) before calling delete(), and they never validate a CSRF token. Because the target UUIDs are read from $_GET, deletion can be triggered by a plain HTTP GET request. When the module is in public mode (documents_files_module_enabled = 1) and a folder is marked public (fol_public = true), an unauthenticated attacker can permanently destroy the entire document library. Even when the module requires login, any user with view-only access can delete content they are only permitted to read. This issue has been fixed in version 5.0.7.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityNone

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected products

Admidio≥ 5.0.0 < 5.0.7

Remediation

Fixed in

Admidio≥ 5.0.7

Patch & vendor advisories

https://github.com/Admidio/admidio/security/advisories/GHSA-rmpj-3x5m-9m5f

References

https://github.com/Admidio/admidio/security/advisories/GHSA-rmpj-3x5m-9m5fExploitMitigationVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-32817 being actively exploited?

CVE-2026-32817 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.48%.

How severe is CVE-2026-32817?

CVE-2026-32817 has a CVSS 3.1 base score of 9.1, rated critical. EPSS estimates a 0.48% probability of exploitation.

Which products are affected by CVE-2026-32817?

Affected products include Admidio.

How do I fix CVE-2026-32817?

Upgrade affected software to a fixed version, for example Admidio 5.0.7 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-32817 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo