CVE-2026-111652: Engineercms through 2.0.5 Missing Authorization via AttachController.Attachment

Q: Who is exposed to this issue?

EngineerCMS deployments through version 2.0.5 are exposed if project image or video attachments are reachable through the attachment endpoint. The affected file types are .jpg, .png, .bmp, and .mp4.

Q: What does an attacker need to exploit it?

An attacker does not need authentication, privileges, or user interaction. They need to know or derive a valid /attachment/* path for an affected attachment file.

Q: Are authorization controls bypassed for affected downloads?

Yes. Affected attachments are served before casbin, owner, or administrator authorization checks are applied.

Q: How can I determine whether data may already be exposed?

Review access logs for requests to /attachment/* paths, particularly requests for .jpg, .png, .bmp, and .mp4 files from unauthenticated clients. Requests for project attachment paths that succeeded without a corresponding authenticated session indicate potential exposure.

Published Oct 16, 2026

Updated

Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachment/ paths for .jpg, .png, .bmp, or .mp4 files, which are served before casbin, owner, or admin checks.

Affected Software

1 affected component

EngineerCMS EngineerCMS<=2.0.5

Event History

Oct 16, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

EngineerCMS deployments through version 2.0.5 are exposed if project image or video attachments are reachable through the attachment endpoint. The affected file types are .jpg, .png, .bmp, and .mp4.

What does an attacker need to exploit it?

An attacker does not need authentication, privileges, or user interaction. They need to know or derive a valid /attachment/* path for an affected attachment file.

Are authorization controls bypassed for affected downloads?

Yes. Affected attachments are served before casbin, owner, or administrator authorization checks are applied.

How can I determine whether data may already be exposed?

Review access logs for requests to /attachment/* paths, particularly requests for .jpg, .png, .bmp, and .mp4 files from unauthenticated clients. Requests for project attachment paths that succeeded without a corresponding authenticated session indicate potential exposure.

CVE-2026-111652: Engineercms through 2.0.5 Missing Authorization via AttachController.Attachment

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are authorization controls bypassed for affected downloads?

How can I determine whether data may already be exposed?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are authorization controls bypassed for affected downloads?

How can I determine whether data may already be exposed?