A flaw in the Password‑Protected Share Handler of kalcaddle kodbox allows an attacker to bypass authentication in the auth.class.php controller. By manipulating the request, an unauthorized user can gain access to protected resources and view or download data that should be restricted. This unauthorized access is a direct result of an authentication failure (CWE-287).

The vulnerability affects kalcaddle kodbox version 1.64. No other vendors or products are listed as impacted.

The CVSS score of 6.3 indicates moderate severity, and the absence of an EPSS entry combined with the fact that it is not listed in CISA's Known Exploited Vulnerabilities catalog suggests limited widespread exploitation so far. However, a public exploit has been released and the attack can be performed remotely. The complexity is high and the exploitability is considered difficult, yet an attacker with sufficient skill can forge a request that bypasses the authentication check and gain unauthorized access.