Initiative is a self-hosted project management platform. Versions before 0.32.2 lack authentication checks when serving documents from the /uploads/ directory. This flaw allows any user to request a file by URL and receive its contents without verification, resulting in confidential data exposure.

The affected product is Morelitea Initiative. All installations running versions earlier than 0.32.2 are vulnerable. The vendor has released version 0.32.2 and a further improvement in 0.32.4 that address the issue.

The CVSS score of 7.5 indicates a medium–high severity, while the EPSS score of less than 1% suggests a low probability of active exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by simply accessing the file URL, bypassing any authentication mechanisms. A successful exploitation would allow an attacker to read any document uploaded by users, compromising confidentiality and potentially exposing sensitive project data.