A critical configuration flaw in Admidio versions 5.0.0 through 5.0.7 allows unauthenticated users to bypass access controls and download sensitive uploaded files.

The vulnerability stems from an improper access control configuration where the Docker image defaults to AllowOverride None, causing Apache to ignore .htaccess directives meant to protect uploaded documents. Consequently, any file uploaded to the documents module is accessible to unauthenticated attackers if they discover the file path, which is disclosed in the upload response.

The exposure of sensitive documents represents a significant risk to data confidentiality, as unauthorized parties can access private user uploads regardless of configured permissions. Given the CVSS score of 7.5, this high-severity vulnerability could lead to the exposure of personally identifiable information or proprietary organizational data, resulting in potential regulatory non-compliance and reputational damage.

Immediate Action: Update Admidio to version 5.0.8 or later, which resolves the configuration dependency and restores proper access control.

Proactive Monitoring: Review web server access logs for anomalous requests to the documents directory, particularly those originating from unauthorized IP addresses.

Compensating Controls: If immediate patching is not feasible, restrict external network access to the upload directory via a Web Application Firewall or server-level configuration to prevent direct HTTP access to files.

Public Exploit Available: No (exploit_available: unknown)

The ability for unauthenticated attackers to bypass file-level permissions poses a severe risk to data integrity and privacy. Organizations running Admidio in a containerized environment must prioritize upgrading to version 5.0.8 immediately to remediate this improper access control flaw and prevent potential data exfiltration.