An unauthenticated access control vulnerability in the Morelitea Initiative platform allows unauthorized users to retrieve sensitive uploaded documents without authorization.

This vulnerability is classified as an improper access control flaw (CWE-284) and missing authorization (CWE-862), where the system fails to enforce security checks on the /uploads/ directory. An unauthenticated attacker can retrieve private files directly via URL, leading to the exposure of sensitive information.

The exposure of sensitive documents can lead to significant data breaches, potential regulatory non-compliance, and the loss of proprietary information. With a CVSS score of 7.5, this high-severity vulnerability poses a substantial risk because it allows for automated, remote exploitation without requiring any user credentials.

Immediate Action: Update the Morelitea Initiative software to version 0.32.4 or later, which incorporates the necessary security patches and improvements for document access control.

Proactive Monitoring: Review web server access logs for anomalous GET requests targeting the /uploads/ directory, particularly from unauthorized or unusual IP addresses.

Compensating Controls: If an immediate update is not feasible, implement a Web Application Firewall (WAF) rule to restrict access to the /uploads/ directory, or move the directory to a non-public location outside of the web root.

Public Exploit Available: Unknown

Given the ease with which sensitive information can be exfiltrated, organizations utilizing Morelitea Initiative must prioritize patching to version 0.32.4 immediately. Failure to update leaves proprietary documentation exposed to any external actor with network access to the server.