An authorization bypass exists in the media file download route. Unauthenticated attackers can access restricted files by submitting path-equivalent URL variants. By using normalized path forms, such as dot-slash prefixes, double slashes, or percent-encoded sequences, attackers can bypass role-based restriction checks. This occurs because the filesystem resolves the request to the protected file despite the security checks, allowing unauthorized file downloads without credentials.