CVE-2026-70561
Received Received - Intake

Insecure Direct Object Reference in TestLink Allowing Unauthorized Attachment Access

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: VulnCheck

Description
TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role authorization check. Attackers can enumerate sequential integer IDs through the attachment download endpoint to retrieve file contents from private projects they have no membership in, bypassing the per-project access control model and exposing test specifications, requirements documents, execution evidence, and other sensitive uploaded files across the entire installation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-70561
EUVD
EUVD-2026-54574

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
testlink testlink to 1.9.20 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-70561 is an Insecure Direct Object Reference (IDOR) vulnerability in TestLink versions 1.9.20 and earlier. It allows any authenticated user, including low-privilege guest accounts, to read arbitrary file attachments by supplying an integer attachment ID to the attachmentdownload.php handler without proper project or role authorization checks. Attackers can enumerate sequential IDs to access sensitive files from private projects they are not authorized to view.

Detection Guidance

To detect this IDOR vulnerability in TestLink, monitor HTTP requests to attachmentdownload.php for sequential integer IDs. Check for repeated access attempts with varying IDs from the same user session. Use tools like Burp Suite or OWASP ZAP to intercept and analyze requests for unauthorized file downloads. Inspect server logs for repeated 200 OK responses to attachmentdownload.php with different IDs.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive data such as test specifications, requirements documents, execution evidence, and other confidential files stored in TestLink. Attackers with even minimal access can bypass project-level restrictions and download files from private projects, compromising the intended privacy model of the application.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. The IDOR flaw allows attackers to access test specifications, requirements documents, and execution evidence, which may contain confidential or personal data, violating these regulations.

Mitigation Strategies

Immediately upgrade TestLink to version 2.x or apply patches addressing the authorization flaw in attachmentdownload.php. Temporarily restrict guest account access to attachments until patched. Implement strict input validation for attachment IDs and enforce role-based access controls. Review server logs for signs of exploitation and revoke access for suspicious users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70561. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart