Open-source User Management Solution Vulnerability in Admidio

CVE-2026-34381

What is CVE-2026-34381?

Admidio, an open-source user management solution, exhibits an improper access control vulnerability that impacts versions from 5.0.0 up to, but not including, 5.0.8. The application mistakenly relies on a .htaccess file to manage file access. When deployed as a Docker image, the Apache configuration with AllowOverride set to None prevents the .htaccess file from being interpreted, leading to a situation where files uploaded through the documents module can be accessed directly over HTTP without the necessary role-based permissions. This issue not only allows unauthorized users to access potentially sensitive files but also reveals the specific file paths through the upload response JSON. A patch addressing this vulnerability has been made available in version 5.0.8.

References