s2
--:--:--UTC

Searching APEX

Starting…

  1. Searching Threats, IOCs & Threat Intelligence locally
  2. Querying external providers
  3. Asking AI Forensic Validator
  4. Creating new entry from validated hit

0s elapsed

CVE-2026-47231

📛 CVE Title

(no title)

Description

Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders

Overview

State
Assigner (CNA)
CVSS severity
high
CVSS score
CVSS 8.1 / 10 8.1 8.1 / 10
CVSS vector
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Effective score
8.1 / 10 HIGH source: CNA overview
CWE(s)
Reserved
Published
Last updated
Source
https://www.tenable.com/cve/CVE-2026-47231
Linked Threat
CVE-2026-47231 — CVE-2026-47231

NVD / KEV / EPSS data refreshed 2026-07-28 00:31 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID
EUVD-2026-57208
Assigner
GitHub_M
Published
Aug 12, 2026, 1:17:16 PM
Updated
Aug 12, 2026, 3:20:40 PM
EUVD base score (CVSS 3.1)
8.1 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EUVD-reported EPSS
0.0000
Vendors
Admidio
Products
admidio (< 5.0.10)
Aliases
GHSA-x628-457g-2pw9

ENISA description: Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` gates state-changing modes by checking that the actor has `hasUploadRight()` on the URL parameter `folder_uuid`. The `move_save` handler then operates on a *separate* URL parameter `file_uuid` and calls `File::moveToFolder($destFolderUUID)`. `File::moveToFolder()` checks the upload right on the destination folder but never on the source folder containing the file. As a result, any user who can upload to any single folder can move any file from any other folder — including private folders to which they have no view rights — into a folder they control, and then download it. Confidentiality is broken (private file contents leak) and integrity is broken (the file is removed from the original location). Version 5.0.10 contains a fix.

EUVD references (1)

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (2)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-47231.json.

Not stored.