What is the CVSS score of CVE-2026-32817?

CVE-2026-32817 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-32817?

Admidio versions 5.0.0-5.0.6 contain a critical vulnerability allowing unauthenticated attackers to permanently delete all documents and files if the documents module is publicly accessible.. A patch is available.

How to fix or mitigate CVE-2026-32817?

Within 24 hours: Immediately disable or restrict public access to the Admidio documents and files module; verify current version and document the exposure scope. Within 7 days: Implement network-level access controls (IP whitelisting, WAF rules) to limit module access to authenticated users only; conduct audit of recent file deletion logs for evidence of exploitation. Within 30 days: Upgrade to patched version when available or migrate to alternative document management solution; restore from backups if unauthorized deletions are confirmed.

PHP CVE-2026-32817

CRITICAL

Missing Authorization (CWE-862)

2026-03-20 security-advisories@github.com

GHSA-rmpj-3x5m-9m5f

CSRF PHP Authentication Bypass

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 02:16 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the documents and files module does not verify whether the current user has permission to delete folders or files. The folder_delete and file_delete action handlers in modules/documents-files.php only perform a VIEW authorization check (getFolderForDownload / getFileForDownload) before calling delete(), and they never validate a CSRF token. Because the target UUIDs are read from $_GET, deletion can be triggered by a plain HTTP GET request. When the module is in public mode (documents_files_module_enabled = 1) and a folder is marked public (fol_public = true), an unauthenticated attacker can permanently destroy the entire document library. Even when the module requires login, any user with view-only access can delete content they are only permitted to read. This issue has been fixed in version 5.0.7.

AnalysisAI

Admidio versions 5.0.0 through 5.0.6 contain a critical authorization bypass vulnerability in the documents and files module that allows unauthorized deletion of folders and files. When the module is configured in public mode, unauthenticated attackers can permanently destroy the entire document library via simple HTTP GET requests without CSRF protection. The vulnerability combines missing authorization checks (CWE-862) with CSRF weaknesses, resulting in a CVSS score of 9.1 (Critical) with network-based attack vector requiring no privileges or user interaction.

Technical ContextAI

The vulnerability exists in the modules/documents-files.php file of Admidio, an open-source PHP-based user management and administration system. The root cause is classified as CWE-862 (Missing Authorization), where the folder_delete and file_delete action handlers only perform VIEW-level authorization checks via getFolderForDownload and getFileForDownload methods before executing delete operations. The handlers accept target UUIDs directly from the $_GET superglobal without validating whether the user has DELETE permissions or verifying CSRF tokens. When documents_files_module_enabled is set to 1 (public mode) and folders are marked with fol_public=true, the module exposes destructive operations to unauthenticated users. Even in restricted mode, users with read-only access can escalate to delete privileges, violating the principle of least privilege and proper role-based access control implementation.

RemediationAI

Immediately upgrade Admidio to version 5.0.7 or later, which contains fixes for the authorization bypass and CSRF vulnerabilities as documented in the GitHub security advisory at https://github.com/Admidio/admidio/security/advisories/GHSA-rmpj-3x5m-9m5f. Organizations unable to upgrade immediately should disable public access to the documents and files module by setting documents_files_module_enabled to 0 or restricting the module to authenticated administrators only. As an additional interim control, implement web application firewall rules to block HTTP GET requests to modules/documents-files.php containing folder_delete or file_delete action parameters from untrusted IP ranges. Review access logs for suspicious deletion activity targeting the documents module and restore deleted content from backups if unauthorized deletions have occurred. After upgrading, verify that folder and file deletion operations properly enforce authorization checks and CSRF token validation.