CVE-2026-111620: O2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint
O2OA through 10.0.2-ce contains an authorization bypass vulnerability in xprocessplatformassemblesurface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the referenced work or draft, so any visitable work or owned draft can be supplied. Attackers who know an attachment UUID can request it through jaxrs/attachment/download/{id}/work/{workId} to read documents attached to other users' processes.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated O2OA user can exploit it if they can access any visitable work or own a draft and know the UUID of an attachment associated with another user's process.
What access does an attacker need to retrieve another work's attachment?
The attacker needs a valid attachment UUID and a work or draft identifier that they are permitted to use. The affected download actions do not verify that the attachment belongs to the referenced work or draft.
How can defenders determine whether they may be exposed?
Systems running O2OA through 10.0.2-ce are affected by the described behavior. Review requests to the attachment download endpoint for attachment IDs paired with work IDs where the attachment is not associated with that work.