Executive brief
Admidio is an open-source platform used by organizations to manage member data and documents. A security flaw in its Docker-based installation allows unauthorized users to bypass access controls and download sensitive files, such as contracts or financial records, without logging in. This occurs because the system's web server is configured to ignore the security rules intended to protect the document storage folder. An attacker who knows or can guess a file's web address can access it directly, potentially leading to a significant data breach.
Technical details
Admidio versions 5.0.0 through 5.0.7 rely on .htaccess files within the 'adm_my_files' directory to restrict direct HTTP access to uploaded documents. However, the official Docker image ships with an Apache configuration set to 'AllowOverride None', which causes the web server to ignore these .htaccess security directives. Consequently, any file uploaded to the documents module is served directly by Apache without performing the application's role-based access control (RBAC) checks. An unauthenticated attacker can retrieve any file if they know the path, which is also leaked in the JSON response during the upload process. The issue is resolved in version 5.0.8 by enabling 'AllowOverride All' for the specific upload directory.
Affected products
- Admidio Admidio >= 5.0.0, < 5.0.8
Timeline
- 2026-03-27: advisory: GitHub Security Advisory published
- 2026-03-31: disclosed: CVE-2026-34381 published to NVD
- 2026-03-31: patched: Fix committed to repository