Typemill before version 2.26.0 contains an authorization bypass vulnerability (CWE-863) in its media file download functionality. The vulnerability arises because the application fails to properly normalize and validate path inputs, allowing attackers to submit path-equivalent URL variants (e.g., dot-slash prefixes, double slashes, percent-encoded sequences) that circumvent role-based restrictions. As a result, unauthenticated attackers can download files that should be restricted, leading to unauthorized data disclosure. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, low complexity, no privileges or user interaction required, and high confidentiality impact with no integrity or availability impact. There are no known exploits in the wild and no official patch or remediation details provided in the source data.

An attacker can download restricted media files without authentication by exploiting path normalization bypasses. This leads to unauthorized disclosure of potentially sensitive files. There is no impact on system integrity or availability reported. The vulnerability affects confidentiality only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the media file download route through external means such as web server configuration or network controls. Monitor for unusual access patterns to media files. Avoid exposing sensitive files in publicly accessible directories.