CVE-2026-41878

UNKNOWN 0.0

Insecure Direct Object Reference in R-SOFT DMS

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

R-SOFT DMS is vulnerable to Insecure Direct Object Reference (IDOR) attack in multiple file download endpoints. The application fetches files from the database by ID and serves them to whoever requests them, relying only on session authentication, meaning any valid user can access any file. This issue was fixed in version v3.19-2862 and v3.17-2580.

CWE	CWE-639
Vendor	r-soft serwis
Product	dms
Published	Jul 10, 2026
Last Updated	Jul 10, 2026

Stay Ahead of the Next One

Get instant alerts for r-soft serwis dms

Be the first to know when new unknown vulnerabilities affecting r-soft serwis dms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

R-SOFT SERWIS / DMS

0 < v3.19-2862 0 < v3.17-2580

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cert.pl: https://cert.pl/posts/2026/07/CVE-2026-41876

Credits

Marek Figielski (Vanilla.pl)