Acora CMS version 10.7.1 contains an improper access control weakness that allows an editor‑privileged user to read sensitive configuration files by manipulating the file parameter on the /Admin/file_manager/file_details.asp endpoint. The vulnerability is classified as CWE‑284 and results in the exposure of system administrator credentials, SMTP settings, database connections, and other confidential information. Once these credentials are obtained, an attacker can gain full administrative control of the CMS, access email services, compromise linked databases, move laterally within the network, and establish long‑term persistence.

The affected software is Acora CMS v10.7.1. No other vendors or products are listed; the vulnerability is specific to this version of the CMS.

The CVSS score of 6.5 indicates a medium severity vulnerability. The EPSS score is below 1%, suggesting a low probability of exploitation, and the flaw is not recorded in the CISA KEV catalog. Exploitation is possible over the web, requiring only that the user have editor privileges. If such a user exists, the attacker can retrieve privileged information, evolving the issue into a full account takeover. The overall risk is moderate due to the credential exposure and potential for systemic compromise.