What is the CVSS score of CVE-2026-34381?

CVE-2026-34381 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Docker are affected by CVE-2026-34381?

Admidio 5.0.0-5.0.7 Docker deployments have a critical configuration flaw that allows unauthenticated attackers to download role-protected documents by directly accessing file paths over HTTP,…. A patch is available.

How to fix or mitigate CVE-2026-34381?

Within 24 hours: Identify all Admidio Docker deployments using versions 5.0.0-5.0.7 and take instances offline or restrict network access. Within 7 days: Upgrade to Admidio 5.0.8 or later (verify availability with vendor), or deploy a reverse proxy (nginx/Apache) with explicit authentication rules for /documents/* paths before Admidio. Within 30 days: Conduct file access audit to identify downloaded files, validate compensating controls in production, and test file access restrictions from unauthenticated clients.

Docker CVE-2026-34381

EUVD-2026-17622 HIGH

Improper Access Control (CWE-284)

2026-03-31 GitHub_M

GHSA-7fh7-8xqm-3g88

Apache Docker Authentication Bypass

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 21:14 euvd

EUVD-2026-17622

Analysis Generated

Mar 31, 2026 - 21:14 vuln.today

CVE Published

Mar 31, 2026 - 20:31 nvd

HIGH 7.5

DescriptionGitHub Advisory

Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, Admidio relies on adm_my_files/.htaccess to deny direct HTTP access to uploaded documents. The Docker image ships with AllowOverride None in the Apache configuration, which causes Apache to silently ignore all .htaccess files. As a result, any file uploaded to the documents module regardless of the role-based permissions configured in the UI, is directly accessible over HTTP without authentication by anyone who knows the file path. The file path is disclosed in the upload response JSON. This issue has been patched in version 5.0.8.

AnalysisAI

Unauthenticated remote access to restricted documents in Admidio 5.0.0-5.0.7 Docker deployments allows disclosure of role-protected files. The Docker image's Apache configuration disables .htaccess processing (AllowOverride None), bypassing intended access controls on uploaded documents. Attackers can directly retrieve files via HTTP without authentication using paths disclosed in upload response JSON. CVSS 7.5 (High) with network-based attack vector and no authentication required. No public exploit identified at time of analysis, though exploitation is straightforward given the configuration flaw.

Technical ContextAI

Admidio is an open-source web-based membership and event management system built on PHP/Apache. The application implements role-based access control for uploaded documents, relying on Apache .htaccess files in the adm_my_files directory to enforce HTTP-level access restrictions. The vulnerability stems from a misconfiguration in the official Docker image where the Apache httpd.conf contains 'AllowOverride None' for the DocumentRoot. This directive instructs Apache to ignore all .htaccess files, effectively disabling the directory-level access controls that Admidio depends upon for security. The CWE-284 (Improper Access Control) classification reflects this failure to properly restrict resource access. When .htaccess files are ignored, Apache serves files directly based on filesystem permissions alone, bypassing the application's intended authentication and authorization checks. The upload functionality exposes full file paths in JSON responses, providing attackers with the exact URLs needed to retrieve documents.

RemediationAI

Vendor-released patch: Admidio version 5.0.8 resolves this issue by correcting the Apache configuration in the Docker image to properly honor .htaccess files. Organizations should immediately upgrade to version 5.0.8 or later, available from the official GitHub repository at https://github.com/Admidio/admidio. The fix is implemented in commit 5f770c1ca81a4f6b02136280cd63316a35aabaaf. For organizations unable to immediately upgrade, temporary mitigation involves manually modifying the Docker image's Apache configuration to set 'AllowOverride All' or 'AllowOverride Limit' for the adm_my_files directory, then rebuilding and redeploying the container. Organizations should also audit web server access logs for unexpected direct requests to paths under /adm_my_files to identify potential unauthorized access. Review and rotate any sensitive documents that may have been exposed during the vulnerability window. Detailed security advisory available at https://github.com/Admidio/admidio/security/advisories/GHSA-7fh7-8xqm-3g88.