CVE-2026-34381

Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, Admidio relies on adm_my_files/.htaccess to deny direct HTTP access to uploaded documents. The Docker image ships with AllowOverride None in the Apache configuration, which causes Apache to silently ignore all .htaccess files. As a result, any file uploaded to the documents module regardless of the role-based permissions configured in the UI, is directly accessible over HTTP without authentication by anyone who knows the file path. The file path is disclosed in the upload response JSON. This issue has been patched in version 5.0.8.

• CWE-284

• https://github.com/Admidio/admidio/commit/5f770c1ca81a4f6b02136280cd63316a35aabaafPatch
• https://github.com/Admidio/admidio/security/advisories/GHSA-7fh7-8xqm-3g88Exploit, Mitigation, Vendor Advisory
• https://github.com/Admidio/admidio/security/advisories/GHSA-7fh7-8xqm-3g88Exploit, Mitigation, Vendor Advisory

Published

Mar 31, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34376PdfDing is a selfhosted PDF manager, viewer and editor offer…7.5
• CVE-2026-34377ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…8.1
• CVE-2026-34378OpenEXR provides the specification and reference implementat…6.5
• CVE-2026-34379OpenEXR provides the specification and reference implementat…7.1
• CVE-2026-3438A reflected cross-site scripting vulnerability exists in Son…5.1
• CVE-2026-34380OpenEXR provides the specification and reference implementat…5.9
• CVE-2026-34382Admidio is an open-source user management solution. From ver…4.6
• CVE-2026-34383Admidio is an open-source user management solution. Prior to…3.5
• CVE-2026-34384Admidio is an open-source user management solution. Prior to…7.3
• CVE-2026-34385Fleet is open source device management software. Prior to 4.…8.1
• CVE-2026-34386Fleet is open source device management software. Prior to 4.…8.8
• CVE-2026-34387Fleet is open source device management software. Prior to 4.…9.8