CVE-2025-51628 is an IDOR vulnerability in the PdfHandler component of Agenzia Impresa Eccobook versions up to 2.81.1. It permits unauthenticated attackers to read confidential documents by exploiting improper access control on the DocumentoId parameter. The vulnerability does not require authentication or user interaction and can be exploited remotely over the network. The CVSS 3.1 vector indicates low attack complexity and no privileges required, with a high impact on confidentiality but no impact on integrity or availability.

Successful exploitation allows an unauthenticated attacker to read confidential documents, compromising confidentiality. There is no impact on integrity or availability. The vulnerability can be exploited remotely without any privileges or user interaction, making it a significant risk for data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the PdfHandler component and monitor for unauthorized access attempts. Avoid exposing the DocumentoId parameter in URLs or requests accessible to unauthenticated users.