CVE-2026-47231 is an authorization bypass in Admidio's file move handler where permission checking and the actual operation target reference different objects. The handler accepts two distinct UUID parameters — folder_uuid (the destination) and file_uuid (the subject being moved) — but hasUploadRight() gates access using the destination folder while move_save operates on the source file. A user with upload permissions to any folder can move files from any other folder in the system, including private folders they cannot access. This collapses the folder isolation model into a universal file-read primitive accessible to anyone with upload rights.
The root cause is structural, not typographical. When a handler accepts multiple independent object references, developers naturally anchor permission checks to the most salient entity — typically the destination — because that's where the operation's intent feels centered. The source object feels passive, a simple reference rather than an authorization boundary. This cognitive pattern has produced identical bugs across decades of web applications in different languages and frameworks.
The 5.0.10 patch presumably adds a source-folder permission check, but the deeper architectural question is whether this was a one-off fix or part of a pattern. Audit your codebase for other handlers accepting multiple '_uuid' parameters where permission checks and operation targets reference different query parameters — that's the fingerprint of this failure mode. Also verify whether hasUploadRight() or similar capability-specific functions are being used as generic authorization gates elsewhere; if so, the permission architecture may be accumulating technical debt faster than the codebase grows. The fix should consolidate permission resolution inside the file object itself — File::moveTo($destFolder) internally resolving against its own container — rather than relying on handlers to correctly wire independent object references.