CVE-2026-32817

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32817", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-16T17:35:36.696Z", "datePublished": "2026-03-20T02:01:22.118Z", "dateUpdated": "2026-03-20T20:02:30.234Z"}, "containers": {"cna": {"title": "Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/Admidio/admidio/security/advisories/GHSA-rmpj-3x5m-9m5f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-rmpj-3x5m-9m5f"}], "affected": [{"vendor": "Admidio", "product": "admidio", "versions": [{"version": ">= 5.0.0, < 5.0.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T02:01:22.118Z"}, "descriptions": [{"lang": "en", "value": "Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the documents and files module does not verify whether the current user has permission to delete folders or files. The folder_delete and file_delete action handlers in modules/documents-files.php only perform a VIEW authorization check (getFolderForDownload / getFileForDownload) before calling delete(), and they never validate a CSRF token. Because the target UUIDs are read from $_GET, deletion can be triggered by a plain HTTP GET request. When the module is in public mode (documents_files_module_enabled = 1) and a folder is marked public (fol_public = true), an unauthenticated attacker can permanently destroy the entire document library. Even when the module requires login, any user with view-only access can delete content they are only permitted to read. This issue has been fixed in version 5.0.7."}], "source": {"advisory": "GHSA-rmpj-3x5m-9m5f", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-20T20:02:21.906671Z", "id": "CVE-2026-32817", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T20:02:30.234Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32817", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-20T20:02:21.906671Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T20:02:26.703Z"}}], "cna": {"title": "Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion", "source": {"advisory": "GHSA-rmpj-3x5m-9m5f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Admidio", "product": "admidio", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.0.7"}]}], "references": [{"url": "https://github.com/Admidio/admidio/security/advisories/GHSA-rmpj-3x5m-9m5f", "name": "https://github.com/Admidio/admidio/security/advisories/GHSA-rmpj-3x5m-9m5f", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the documents and files module does not verify whether the current user has permission to delete folders or files. The folder_delete and file_delete action handlers in modules/documents-files.php only perform a VIEW authorization check (getFolderForDownload / getFileForDownload) before calling delete(), and they never validate a CSRF token. Because the target UUIDs are read from $_GET, deletion can be triggered by a plain HTTP GET request. When the module is in public mode (documents_files_module_enabled = 1) and a folder is marked public (fol_public = true), an unauthenticated attacker can permanently destroy the entire document library. Even when the module requires login, any user with view-only access can delete content they are only permitted to read. This issue has been fixed in version 5.0.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T02:01:22.118Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32817", "state": "PUBLISHED", "dateUpdated": "2026-03-20T20:02:30.234Z", "dateReserved": "2026-03-16T17:35:36.696Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-20T02:01:22.118Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "admidio", "vendor": "Admidio", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.0.7"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*", "matchCriteriaId": "4020E2FE-8E51-405F-86CB-DAAFBA7FD9B3", "versionEndExcluding": "5.0.7", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the documents and files module does not verify whether the current user has permission to delete folders or files. The folder_delete and file_delete action handlers in modules/documents-files.php only perform a VIEW authorization check (getFolderForDownload / getFileForDownload) before calling delete(), and they never validate a CSRF token. Because the target UUIDs are read from $_GET, deletion can be triggered by a plain HTTP GET request. When the module is in public mode (documents_files_module_enabled = 1) and a folder is marked public (fol_public = true), an unauthenticated attacker can permanently destroy the entire document library. Even when the module requires login, any user with view-only access can delete content they are only permitted to read. This issue has been fixed in version 5.0.7."}, {"lang": "es", "value": "Admidio es una soluci\u00f3n de gesti\u00f3n de usuarios de c\u00f3digo abierto. En las versiones 5.0.0 a 5.0.6, el m\u00f3dulo de documentos y archivos no verifica si el usuario actual tiene permiso para eliminar carpetas o archivos. Los manejadores de acciones folder_delete y file_delete en modules/documents-files.php solo realizan una verificaci\u00f3n de autorizaci\u00f3n de VISTA (getFolderForDownload / getFileForDownload) antes de llamar a delete(), y nunca validan un token CSRF. Debido a que los UUID de destino se leen de $_GET, la eliminaci\u00f3n puede ser activada por una solicitud HTTP GET simple. Cuando el m\u00f3dulo est\u00e1 en modo p\u00fablico (documents_files_module_enabled = 1) y una carpeta est\u00e1 marcada como p\u00fablica (fol_public = true), un atacante no autenticado puede destruir permanentemente toda la biblioteca de documentos. Incluso cuando el m\u00f3dulo requiere inicio de sesi\u00f3n, cualquier usuario con acceso de solo lectura puede eliminar contenido que solo tiene permiso para leer. Este problema ha sido solucionado en la versi\u00f3n 5.0.7."}], "id": "CVE-2026-32817", "lastModified": "2026-06-17T10:36:24.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32817", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-20T20:02:21.906671Z", "version": "2.0.3"}}]}, "published": "2026-03-20T02:16:35.380", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-rmpj-3x5m-9m5f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.0.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "admidio", "source": "cna", "vendor": "Admidio"}, "product": "admidio", "vendor": "admidio"}], "analysis": {"en": {"generated_at": "2026-03-23T14:36:43.291014+00:00", "value": {"mitigation_remediation": ["Upgrade Admidio to version 5.0.7 or later where the authorization and CSRF checks have been fixed.", "If an upgrade cannot be performed immediately, disable the documents and files module or configure it so that deletion is not available to users in public mode and enforce authentication for all module actions.", "Verify that the application validates CSRF tokens on all state\u2011changing requests and that delete operations are restricted to users with explicit permission."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Deletion of Documents and Folders"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Admidio installations using the documents and files module, specifically versions from 5.0.0 to 5.0.6. If the module is enabled in public mode and a folder is marked as public, an unauthenticated user can delete the entire library. Even in protected mode, any user who can view the content can delete it if they have view\u2011only access.", "description_and_impact": "Admidio versions 5.0.0 through 5.0.6 allow deletion of folders and files without confirming that the requesting user has permission to do so, and they do not verify a CSRF token. The deletion logic sits behind a simple view check only, meaning that anyone able to trigger the delete action can remove content. This results in permanent loss of documents and a potential denial of service for the document library.", "risk_and_exploitability": "The CVSS score of 9.1 indicates a critical severity. Although the EPSS score is below 1%, the lack of required authentication or CSRF protection makes exploitation straightforward by sending a GET request to the delete endpoint. The vulnerability is not yet tracked in the CISA KEV catalog, but the ability to remove critical data poses a significant risk to confidentiality, integrity, and availability. An attacker can achieve complete data loss by exploiting this flaw without needing to bypass authentication. "}}}}, "created": "2026-03-20T08:53:09.819730+00:00", "updated": "2026-03-25T14:09:39.227253+00:00", "vendors": ["admidio", "admidio$PRODUCT$admidio"]}