CVE-2026-71234: Documize Community: Attachment Download Authorization Bypass via Non-Validated secure Token
Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a secure query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value. Any non-empty string, such as ?secure=x, bypasses authentication entirely and allows downloading any organization's attachments. Sibling handlers in the same file (togglePublish, delete) correctly enforce session-based authorization, confirming this is an inconsistency rather than intended design.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71234?
CVE-2026-71234 has a severity rating of high, with a score of 7.5.
How do I fix CVE-2026-71234?
To fix CVE-2026-71234, implement proper validation on the 'secure' query parameter to ensure it matches an expected token.
What type of vulnerability is CVE-2026-71234?
CVE-2026-71234 is an Authorization Bypass vulnerability that allows unauthorized access to attachments.
Which software is affected by CVE-2026-71234?
CVE-2026-71234 affects Documize Community.
What impact does CVE-2026-71234 have on security?
CVE-2026-71234 could lead to unauthorized access to sensitive attachments due to insufficient authorization checks.