CVE-2026-47226 represents a second authorization bypass in Admidio's file deletion logic, following GHSA-rmpj-3x5m-9m5f which was partially patched in v5.0.7. The root cause is structural: the file_delete handler validates the attacker's folder_uuid parameter for upload rights while performing the actual deletion on a file_uuid resolved from a different folder context. These are two separate authorization checks using different trust sources — one validates against attacker-supplied input, the other against the file's actual location. That gap is the vulnerability, not whichever specific parameter combination triggered the latest report.
The pattern here mirrors documented recurrences in other PHP applications: Django, WordPress, and Drupal have all seen this exact vulnerability class emerge repeatedly — narrow patches that close one parameter combination while the underlying authorization architecture remains unchanged. The v5.0.7 → v5.0.9 → v5.0.10 timeline across the same GHSA demonstrates this is now the third variant. Expect more: the pattern has reproduced twice, and the trust model that produces it hasn't been redesigned.
The CVSS 6.5 rating warrants scrutiny. The minimum privilege required is view access on a restricted folder — being able to see a file is the prerequisite for permanently destroying it. In Admidido's deployment context (organizations managing members, roles, and events), deleted files represent institutional memory that cannot be recovered. The scoring framework treats file deletion as temporary availability loss, but this is permanent data destruction of potentially high-sensitivity organizational records.
Actionable steps: audit all handlers in the codebase that perform authorization checks against user-supplied parameters while operating on resources resolved from different contexts. Any endpoint that checks upload/write rights via URL parameters while mutating files from a database-resolved location is vulnerable to this same bypass class. Prioritize handlers involving folder_uuid, file_uuid, or equivalent identifier parameters. Treat the v5.0.7 patch delta as informational — it discloses which parameter combination was blocked, implicitly confirming the underlying trust model remains exploitable through different combinations.