Admidio versions 5.0.0 through 5.0.6 allow deletion of folders and files without confirming that the requesting user has permission to do so, and they do not verify a CSRF token. The deletion logic sits behind a simple view check only, meaning that anyone able to trigger the delete action can remove content. This results in permanent loss of documents and a potential denial of service for the document library.

The vulnerability affects Admidio installations using the documents and files module, specifically versions from 5.0.0 to 5.0.6. If the module is enabled in public mode and a folder is marked as public, an unauthenticated user can delete the entire library. Even in protected mode, any user who can view the content can delete it if they have view‑only access.

The CVSS score of 9.1 indicates a critical severity. Although the EPSS score is below 1%, the lack of required authentication or CSRF protection makes exploitation straightforward by sending a GET request to the delete endpoint. The vulnerability is not yet tracked in the CISA KEV catalog, but the ability to remove critical data poses a significant risk to confidentiality, integrity, and availability. An attacker can achieve complete data loss by exploiting this flaw without needing to bypass authentication.