CVE-2026-34381: Admidio Information Disclosure Flaw

CVE-2026-34381 Overview

CVE-2026-34381 is an authentication bypass vulnerability affecting Admidio, an open-source user management solution. The vulnerability exists in the Docker image deployment where the Apache configuration ships with AllowOverride None, causing Apache to silently ignore all .htaccess files. This misconfiguration allows unauthenticated access to uploaded documents that should be protected by role-based permissions configured in the UI.

Critical Impact

Any file uploaded to the documents module is directly accessible over HTTP without authentication by anyone who knows the file path. The file path is disclosed in the upload response JSON, making exploitation trivial.

Affected Products

• Admidio versions 5.0.0 to before 5.0.8
• Admidio Docker image deployments using default Apache configuration

Discovery Timeline

• 2026-03-31 - CVE-2026-34381 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-34381

Vulnerability Analysis

This vulnerability represents a classic case of security control bypass due to deployment configuration mismatch. Admidio's document protection mechanism relies on an .htaccess file located at adm_my_files/.htaccess to deny direct HTTP access to uploaded documents. This approach works correctly in standard Apache installations where AllowOverride is enabled for the relevant directories.

However, the Docker image ships with AllowOverride None in the Apache configuration. When Apache encounters this directive, it completely ignores any .htaccess files in the affected directory tree. The application continues to function normally from a user perspective, but the critical access control enforcement at the web server level is silently disabled.

The attack surface is expanded by the fact that file paths are disclosed in the upload response JSON. An authenticated user with upload permissions can observe the file path structure and potentially share or leak paths to sensitive documents. Alternatively, attackers may be able to guess or enumerate file paths based on predictable naming conventions.

Root Cause

The root cause is a misconfiguration in the Docker image's Apache settings where AllowOverride None prevents Apache from processing the .htaccess file that Admidio relies upon for access control. The application's security model assumes the web server will enforce directory-level access restrictions via .htaccess, but this assumption fails in the containerized deployment environment.

Attack Vector

An attacker can exploit this vulnerability by directly requesting URLs to uploaded files in the adm_my_files directory. Since the .htaccess protections are ignored, the web server serves the files without requiring authentication or verifying role-based permissions. The attacker needs to know or guess the file path, which is facilitated by the path disclosure in upload response JSON.

# Security patch in dockerscripts/startup.sh - Merge commit from fork
     rm -f "${ADMIDIO_INSTALLED_VERSION}"
 fi
 
+# allow .htaccess overrides for admidio custom directory
+echo "[INFO ] add custom Apache directory config"
+cat <<EOF > /etc/apache2/conf-available/admidio-custom.conf
+<Directory /opt/app-root/src/adm_my_files>
+    AllowOverride All
+</Directory>
+EOF
+
+a2enconf admidio-custom
+
 # run apache config test (apachectl configtest)
 echo "[INFO ] run apache config test (apachectl configtest)"
 apachectl configtest

Source: GitHub Commit Update

Detection Methods for CVE-2026-34381

Indicators of Compromise

• Direct HTTP requests to paths under /adm_my_files/ that bypass the application's normal document access workflow
• Access log entries showing successful retrieval of files from the documents directory without corresponding application session activity
• Unusual patterns of file path enumeration attempts targeting the adm_my_files directory

Detection Strategies

• Monitor Apache access logs for direct requests to /adm_my_files/ paths, especially from unauthenticated sessions
• Implement web application firewall rules to detect and alert on direct access attempts to the documents directory
• Review Apache configuration to verify AllowOverride All is set for the adm_my_files directory

Monitoring Recommendations

• Enable verbose logging for the adm_my_files directory to track all access attempts
• Set up alerts for high volumes of 200 responses from the documents directory without corresponding authenticated sessions
• Regularly audit Apache configuration files in Docker deployments to ensure security directives are properly applied

How to Mitigate CVE-2026-34381

Immediate Actions Required

• Upgrade Admidio to version 5.0.8 or later immediately
• If immediate upgrade is not possible, manually configure Apache to allow .htaccess overrides for the adm_my_files directory
• Audit access logs for any evidence of unauthorized document access
• Review and rotate any sensitive documents that may have been exposed

Patch Information

The vulnerability has been patched in Admidio version 5.0.8. The fix modifies the Docker startup script to create an Apache configuration file that explicitly enables AllowOverride All for the /opt/app-root/src/adm_my_files directory, ensuring that the .htaccess file is properly processed. For detailed patch information, see the GitHub Security Advisory GHSA-7fh7-8xqm-3g88 and the patch commit.

Workarounds

• Manually add an Apache configuration to enable AllowOverride All for the adm_my_files directory
• Deploy Admidio in a non-Docker environment where .htaccess processing is enabled by default
• Implement network-level access controls to restrict access to the documents directory to trusted internal networks only

# Configuration example
# Add to Apache configuration or create /etc/apache2/conf-available/admidio-custom.conf
<Directory /opt/app-root/src/adm_my_files>
    AllowOverride All
</Directory>

# Enable the configuration
a2enconf admidio-custom
apachectl graceful