Multiple Authorization and CSRF Vulnerabilities in Admidio

Several newly disclosed Admidio vulnerabilities allow unauthorized or improperly authorized state-changing actions in core modules handling roles, documents, and forums. One flaw in modules/groups-roles/groups_roles.php is a CSRF issue that can let an attacker trick an authenticated user with rol_assign_roles privileges into activating, deactivating, or deleting organizational roles because the server does not properly enforce anti-CSRF validation for some sensitive requests. Additional Admidio issues stem from missing authorization checks on destructive actions, allowing operations to proceed after insufficient validation.

In the documents module, modules/documents-files.php uses read-access checks such as getFolderForDownload() and getFileForDownload() before executing folder_delete and file_delete, which can let any user who can view a file or folder delete it; in public-mode configurations, that can extend to unauthenticated deletion of public content. In the forum module, modules/forum.php validates a CSRF token for topic_delete and post_delete actions but fails to verify whether the requester is actually authorized to delete the targeted content, enabling arbitrary forum post or topic deletion. A separate disclosure affecting Campus Educativa describes an IDOR at /administracion/admin_usuarios.cgi that exposes enrolled-user data through brute-forced course IDs, but that is a different product and incident and should be treated separately.