The vulnerability is an insecure direct object reference in Admidio’s file‑rename function. The code checks the user’s upload permission only for the folder identified by the folder_uuid parameter, but when a rename (mode file_rename_save) is requested it resolves the target file using a different file_uuid parameter without revalidating that the user has upload rights to the folder that actually contains that file. Consequently, a user who can upload to any folder can rename and modify the description of a file located in a different folder, provided the user can view the target file. This allows an attacker to tamper with stored files and metadata, undermining data integrity and extending the attacker’s capabilities beyond the permissions granted to the user’s role.

Admidio, the open‑source user‑management platform. All releases prior to 5.0.10 are affected. The flaw resides in the modules/documents-files.php component and applies to every supported installation of Admidio that has not been patched to or beyond version 5.0.10.

The CVSS base score of 6.5 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, so the current probability of exploitation is unknown. However, the attack can be performed by any authenticated user who possesses upload rights to at least one folder, which is a common permission set in typical deployments. Exploitation requires only standard application interaction: the attacker logs in, invokes the rename operation, supplies the file_uuid of a view‑able file, and provides a new file name. Because the rename proceeds without re‑checking the source folder’s upload rights, the attacker effectively bypasses the intended access controls and can silently alter or overwrite files as if they had administrative privileges.