Admidio contains a missing authorization check that lets an authenticated user with upload rights on any one folder permanently delete files from folders where the user only has view rights. The flaw resides in file deletion logic that verifies the folder_uuid parameter supplied by the requester against the target location, rather than validating the file’s actual parent folder. As a result, an attacker can submit a folder_uuid that they own while specifying a file_uuid that points to a protected document, effectively bypassing the delete‑rights check and removing the file from the system.

All Admidio installations that are older than version 5.0.10 are affected. The issue appears in the 5.0.x line, including 5.0.7 where a partial fix was applied and 5.0.9 where the flaw resurfaced. Only the 5.0.10 release contains a full resolution, so any installation prior to that should be updated.

The vulnerability receives a CVSS score of 6.5, indicating moderate severity. Exploitation requires a compromised or insider account that has upload rights in at least one folder, so the attack surface is limited to authenticated users. Based on the description, it is inferred that an attacker can trigger the flaw by forging a file_delete request with a legitimate folder_uuid and a target file_uuid. Because the EPSS score is not published, we infer that no public exploitation probability is currently available. The flaw permits permanent loss of data integrity and could expose sensitive information if critical documents are deleted.