# CVE-2026-34381: Admidio improper access control in Docker image document storage

Source: https://junglewise.ai/threats/cve-2026-34381-admidio-improper-access-control-in-docker-image-document-storage  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-34381 · Severity: high · CVSS 7.5 · Published 2026-03-31

Admidio is an open-source platform used by organizations to manage member data and documents. A security flaw in its Docker-based installation allows unauthorized users to bypass access controls and download sensitive files, such as contracts or financial records, without logging in. This occurs because the system's web server is configured to ignore the security rules intended to protect the document storage folder. An attacker who knows or can guess a file's web address can access it directly, potentially leading to a significant data breach.

Technologies: [Admidio](https://junglewise.ai/threats/technologies/admidio), [admidio/admidio (Packagist)](https://junglewise.ai/threats/technologies/admidio-admidio). Vendors: [Admidio](https://junglewise.ai/threats/vendors/admidio), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-34381 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34381 being exploited in the wild.

**How severe is CVE-2026-34381?** High severity, with a CVSS score of 7.5, published 31 March 2026.

**Which products and versions are affected?** Admidio >= 5.0.0, < 5.0.8; admidio/admidio (Packagist) ECOSYSTEM:introduced=5.0.0,fixed=5.0.8.

**Is there a fix for CVE-2026-34381?** Yes. admidio/admidio (Packagist): upgrade to 5.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34381 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-34381?** Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- admidio/admidio (Packagist): upgrade to 5.0.8 or later

  ```sh
  composer require admidio/admidio:^5.0.8
  ```


## Technical details

Admidio versions 5.0.0 through 5.0.7 rely on .htaccess files within the 'adm_my_files' directory to restrict direct HTTP access to uploaded documents. However, the official Docker image ships with an Apache configuration set to 'AllowOverride None', which causes the web server to ignore these .htaccess security directives. Consequently, any file uploaded to the documents module is served directly by Apache without performing the application's role-based access control (RBAC) checks. An unauthenticated attacker can retrieve any file if they know the path, which is also leaked in the JSON response during the upload process. The issue is resolved in version 5.0.8 by enabling 'AllowOverride All' for the specific upload directory.

## Affected products

- Admidio Admidio >= 5.0.0, < 5.0.8

## Identifiers

- CVE-2026-34381
- GHSA-7fh7-8xqm-3g88

## Timeline

- 2026-03-27: advisory: GitHub Security Advisory published
- 2026-03-31: disclosed: CVE-2026-34381 published to NVD
- 2026-03-31: patched: Fix committed to repository

## References

- [https://github.com/Admidio/admidio/commit/5f770c1ca81a4f6b02136280cd63316a35aabaaf](https://github.com/Admidio/admidio/commit/5f770c1ca81a4f6b02136280cd63316a35aabaaf)
- [https://github.com/Admidio/admidio/security/advisories/GHSA-7fh7-8xqm-3g88](https://github.com/Admidio/admidio/security/advisories/GHSA-7fh7-8xqm-3g88)

## Related threats

- [Admidio improper access control in event registration](https://junglewise.ai/threats/cve-2026-117554-admidio-before-5-0-17-contains-an-improper-access-control)
- [Admidio information disclosure in RSS weblinks feed](https://junglewise.ai/threats/cve-2026-111916-admidio-before-5-0-16-contains-an-information-disclosure)
- [Admidio broken access control in inventory module](https://junglewise.ai/threats/cve-2026-111914-admidio-from-5-0-11-before-5-0-16-contains-a-broken-access)
- [Admidio authorization bypass via pdfl export mode](https://junglewise.ai/threats/cve-2026-111913-admidio-from-5-0-0-before-5-0-16-contains-an-authorization)
- [Admidio forum topic authorization bypass in ForumService::saveTopic()](https://junglewise.ai/threats/cve-2026-111912-admidio-from-5-0-0-before-5-0-16-contains-an-insecure-direct)