Hyland Alfresco Enterprise contains an incorrect authorization vulnerability (CWE-863) that permits unauthenticated attackers to access arbitrary files in protected directories through the /share/page/resource/ endpoint. This flaw exposes sensitive configuration files that should be restricted, potentially compromising system confidentiality. The vulnerability affects multiple versions including 7.4.0, 23.6.0, and 25.1.0. It has a CVSS 4.0 base score of 8.7, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality. No patch or official fix details are currently available, and no exploits have been observed in the wild.

Successful exploitation allows unauthenticated attackers to read sensitive files from protected directories, potentially exposing configuration details that could aid further attacks or information disclosure. The impact is primarily confidentiality loss with high severity as indicated by the CVSS score. There is no indication of integrity or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict external access to the /share/page/resource/ endpoint if possible, and monitor for unusual file access attempts. Follow vendor communications closely for official patches or mitigations.