An improper access control vulnerability exists in DDSN Interactive cm3 Acora CMS version 10.7.1 where users with editor privileges can force browse the /Admin/file_manager/file_details.asp endpoint and manipulate the file parameter to retrieve sensitive configuration files such as cm3.xml. These files contain critical information including system administrator credentials, SMTP settings, and database credentials. Exploiting this vulnerability can lead to privilege escalation, account takeover, and systemic compromise of the CMS and its infrastructure. The CVSS 3.1 base score is 6.5 with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact.

Exposure of sensitive configuration files can lead to full administrative access to the CMS, unauthorized access to email services, compromise of backend databases, lateral movement within the network, and long-term persistence by an attacker. This vulnerability poses a critical risk of account takeover and privilege escalation despite the medium CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict editor-level user access and monitor for unauthorized access attempts to the /Admin/file_manager/file_details.asp endpoint. Avoid granting editor privileges to untrusted users and consider additional access controls or web application firewall rules to limit access to sensitive endpoints.