eladmin contains a missing authorization flaw in the downloadS3Storage handler. An authenticated user can call the endpoint GET /api/s3Storage/download/{id} with arbitrary ids, causing the application to return publicly readable URLs to S3 objects. By enumerating sequential identifiers, attackers can gather URLs to all stored objects, compromising the confidentiality of any data placed in publicly accessible buckets.

The vulnerability exists in the elunez eladmin product, specifically within commit 55fbf70 of the eladmin codebase. Any deployment based on this commit or earlier is affected. Fixed versions are not listed, so operators should verify if subsequent releases contain the patch.

The CVSS score of 5.3 indicates a moderate risk. Although the EPSS score is not available, the vulnerability is exploitable by any authenticated user with access to the platform, removing the need for elevated privileges. Attackers can enumerate object IDs to harvest URLs, exposing data that might be publicly readable in S3. The vulnerability is not listed in CISA's KEV catalog, but its impact on data confidentiality means it should be treated with urgency.