CVE-2026-47226

CVE-2026-47226 represents a second authorization bypass in Admidio's file deletion logic, following GHSA-rmpj-3x5m-9m5f which was partially patched in v5.0.7. The root cause is structural: the `file_delete` handler validates the attacker's `folder_uuid` parameter for upload rights while performing the actual deletion on a `file_uuid` resolved from a different folder context. These are two separate authorization checks using different trust sources — one validates against attacker-supplied input, the other against the file's actual location. That gap is the vulnerability, not whichever specific parameter combination triggered the latest report. The pattern here mirrors documented recurrences in other PHP applications: Django, WordPress, and Drupal have all seen this exact vulnerability class emerge repeatedly — narrow patches that close one parameter combination while the underlying authorization architecture remains unchanged. The v5.0.7 → v5.0.9 → v5.0.10 timeline across the same GHSA demonstrates this is now the third variant. Expect more: the pattern has reproduced twice, and the trust model that produces it hasn't been redesigned. The CVSS 6.5 rating warrants scrutiny. The minimum privilege required is view access on a restricted folder — being able to see a file is the prerequisite for permanently destroying it. In Admidido's deployment context (organizations managing members, roles, and events), deleted files represent institutional memory that cannot be recovered. The scoring framework treats file deletion as temporary availability loss, but this is permanent data destruction of potentially high-sensitivity organizational records. Actionable steps: audit all handlers in the codebase that perform authorization checks against user-supplied parameters while operating on resources resolved from different contexts. Any endpoint that checks upload/write rights via URL parameters while mutating files from a database-resolved location is vulnerable to this same bypass class. Prioritize handlers involving `folder_uuid`, `file_uuid`, or equivalent identifier parameters. Treat the v5.0.7 patch delta as informational — it discloses which parameter combination was blocked, implicitly confirming the underlying trust model remains exploitable through different combinations.

Reviewed through automated stages and approved by a human before publication.