Admidio is an open-source user management solution. Prior to version 5.0.10, "modules/documents-files.php" mode "file_rename_save" shares the same root-cause shape as the cross-folder move bug ("05-documents-cross-folder-move-idor.md"): the top-level rights check at lines 79-89 validates "hasUploadRight()" on the URL parameter "folder_uuid", but the rename operation acts on "file_uuid" — a separate URL parameter — without re-checking the folder that actually contains the file. "DocumentsService::renameFile()" resolves the target file via "getFileForDownload()" (which permits view-readable files) but does not require upload right on the file's source folder. Result: a user with upload right on any folder A can rename a file in folder B as long as they can view it. They can also overwrite the file's description. Version 5.0.10 contains a fix.