CVE-2026-71234
Documize Community: Attachment Download Authorization Bypass via Non-Validated secure Token
Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a `secure` query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value. Any non-empty string, such as ?secure=x, bypasses authentication entirely and allows downloading any organization's attachments. Sibling handlers in the same file (togglePublish, delete) correctly enforce session-based authorization, confirming this is an inconsistency rather than intended design.
| CWE | CWE-863 |
| Vendor | documize |
| Product | community |
| Published | Aug 5, 2026 |
| Last Updated | Aug 5, 2026 |
Get instant alerts for documize community
Be the first to know when new high vulnerabilities affecting documize community are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N