This vulnerability affects the fileGet endpoint in kodcloud KodExplorer versions 4.0 through 4.52. Specifically, improper authentication arises from how the fileUrl parameter is handled in the /app/controller/share.class.php file, allowing an attacker to bypass authentication mechanisms remotely. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is available, and the vendor has not responded to disclosure attempts.

Successful exploitation allows an unauthenticated remote attacker to bypass authentication controls in the fileGet endpoint, potentially granting unauthorized access to files or resources managed by KodExplorer. The impact is rated medium based on the CVSS score of 6.9, indicating limited but significant confidentiality, integrity, and availability impacts. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official patch or workaround is available, users should monitor for updates from kodcloud. Until a fix is released, restricting external access to the affected endpoint or implementing additional access controls may reduce risk.