CVE-2026-34381 Details
Description
Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, Admidio relies on adm_my_files/.htaccess to deny direct HTTP access to uploaded documents. The Docker image ships with AllowOverride None in the Apache configuration, which causes Apache to silently ignore all .htaccess files. As a result, any file uploaded to the documents module regardless of the role-based permissions configured in the UI, is directly accessible over HTTP without authentication by anyone who knows the file path. The file path is disclosed in the upload response JSON. This issue has been patched in version 5.0.8.
A vulnerability in Admidio versions 5.0.0 prior to 5.0.8 allows unauthenticated access to role-restricted documents. The issue arises because the Docker image's Apache configuration ignores .htaccess files, which are intended to deny direct HTTP access to uploaded documents. As a result, files uploaded to the documents module are accessible over HTTP without authentication, regardless of the role-based permissions set in the user interface. The vulnerability has been patched in version 5.0.8.
Users are advised to update to Admidio version 5.0.8 or later. Alternatively, .htaccess overrides can be enabled in the Apache configuration, uploaded files can be moved outside the web root and served through Admidio's download handler, or an explicit deny can be set at the Apache level for the upload directory.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Admidio/admidio/security/advisories/GHSA-7fh7-8xqm-3g88 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/Admidio/admidio/commit/5f770c1ca81a4f6b02136280cd63316a35aabaaf | [email protected] | Patch |
| https://github.com/Admidio/admidio/security/advisories/GHSA-7fh7-8xqm-3g88 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| admidio admidio | >= 5.0.0, < 5.0.8 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 1, 2026 | Initial Analysis | [email protected] |
| Apr 1, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | New CVE Received | [email protected] |