An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.