Hyland Alfresco possesses an endpoint, "/share/page/resource/", that can be accessed without authentication. By requesting any file path through this endpoint, an attacker can read arbitrary files located in protected directories such as WEB-INF. The resulting exposure of configuration files constitutes a significant breach of confidentiality, potentially enabling further attacks on the system. This weakness is identified as a CWE-863 Improper Authorization error, allowing unauthenticated users to access protected resources.

The vulnerability affects both the Hyland Alfresco Community and the Hyland Alfresco Enterprise editions. Any deployment of these products that includes the /share/page/resource/ endpoint and exposes configuration directories, particularly WEB-INF, is potentially susceptible. The issue is present across all supported versions of the product family that have this endpoint, as no specific version restrictions are listed.

The CVSS score of 8.7 indicates a high impact with broad exploitation potential, but the EPSS score of less than 1% suggests that the likelihood of real-world exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog, so no known active exploits have been reported to date. An attacker could exploit it remotely without credentials, though the attack would still require the ability to send HTTP requests to the vulnerable application. The lack of a published patch at this time increases the urgency for customers to monitor for an official fix or implement interim controls.