CVE-2026-71234

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71234", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-05T10:53:53.175Z", "datePublished": "2026-08-05T10:56:21.680Z", "dateUpdated": "2026-08-10T11:45:33.973Z"}, "containers": {"cna": {"title": "Documize Community - Attachment Download Authorization Bypass via Non-Validated secure Token", "descriptions": [{"lang": "en", "value": "Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value.</p>"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-863 Incorrect Authorization", "cweId": "CWE-863", "type": "CWE"}]}], "affected": [{"vendor": "documize", "product": "community", "programFiles": ["domain/attachment/endpoint.go"], "versions": [{"version": "0", "status": "affected"}], "defaultStatus": "unknown"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}}], "references": [{"url": "https://github.com/documize/community", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Alijonov Alisher", "type": "finder"}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:45:33.973Z"}, "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-08-05T10:56:21.680Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T12:55:24.153910Z", "id": "CVE-2026-71234", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T12:55:30.759Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71234", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T12:55:24.153910Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T12:55:27.516Z"}}], "cna": {"title": "Documize Community - Attachment Download Authorization Bypass via Non-Validated secure Token", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Alijonov Alisher"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "documize", "product": "community", "versions": [{"status": "affected", "version": "0"}], "programFiles": ["domain/attachment/endpoint.go"], "defaultStatus": "unknown"}], "datePublic": "2026-08-05T10:56:21.680Z", "references": [{"url": "https://github.com/documize/community", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value.", "supportingMedia": [{"type": "text/html", "value": "<p>Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:45:33.973Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71234", "state": "PUBLISHED", "dateUpdated": "2026-08-10T11:45:33.973Z", "dateReserved": "2026-08-05T10:53:53.175Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-05T10:56:21.680Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "community", "programFiles": ["domain/attachment/endpoint.go"], "vendor": "documize", "versions": [{"status": "affected", "version": "0"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value."}, {"lang": "es", "value": "La ruta de descarga de archivos adjuntos de Documize Community (domain/attachment/endpoint.go, funci\u00f3n Download, registrada a trav\u00e9s de AddPublic sin middleware de autenticaci\u00f3n) acepta un par\u00e1metro de consulta \u2019secure\u2019 y otorga acceso siempre que el par\u00e1metro simplemente no est\u00e9 vac\u00edo (len(secureToken) mayor que 0), sin compararlo con ning\u00fan valor almacenado en el servidor. Cualquier cadena no vac\u00eda, como ?secure=x, omite la autenticaci\u00f3n por completo y permite descargar los archivos adjuntos de cualquier organizaci\u00f3n. Los manejadores hermanos en el mismo archivo (togglePublish, delete) aplican correctamente la autorizaci\u00f3n basada en sesi\u00f3n, confirmando que esto es una inconsistencia en lugar de un dise\u00f1o intencionado."}], "id": "CVE-2026-71234", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71234", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T12:55:24.153910Z", "version": "2.0.3"}}]}, "published": "2026-08-05T11:16:26.120", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/documize/community"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "community", "source": "cna", "vendor": "documize"}, "product": "community", "vendor": "documize"}], "created": "2026-08-05T12:30:12.420120+00:00", "updated": "2026-08-10T22:00:05.262405+00:00", "vendors": ["documize", "documize$PRODUCT$community"]}