Admidio versions 5.0.0 through 5.0.7 allow uploaded files in the documents module to be accessed directly via HTTP because the .htaccess file that is meant to block access is ignored when the Apache configuration uses AllowOverride None. The vulnerability is caused by improper enforcement of access control, resulting in potentially sensitive documents being exposed without authentication. This weakness corresponds to CWE‑284, which addresses unauthorized access control.

The flaw affects the Admidio user‑management application, specifically versions 5.0.0 up to, but not including, 5.0.8. The issue is present in the official Docker image where the Apache instance is configured with AllowOverride None. It applies to any deployment of Admidio in this range that utilizes the same Apache configuration, regardless of the underlying operating system.

The CVSS score of 7.5 indicates a medium‑high severity, while the EPSS score of less than 1% suggests low current exploitation activity and the vulnerability is not listed in CISA’s KEV catalog. An attacker can leverage this flaw by taking the file path disclosed in the upload response JSON and making a GET request to that URL, thereby retrieving the file without authentication. The attack requires no special privileges or exploitation code, only the configuration gap where .htaccess directives are ignored.