CVE-2026-71234
Received Received - Intake

Authentication Bypass in Documize Community via Insecure Attachment Download

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a `secure` query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value. Any non-empty string, such as ?secure=x, bypasses authentication entirely and allows downloading any organization's attachments. Sibling handlers in the same file (togglePublish, delete) correctly enforce session-based authorization, confirming this is an inconsistency rather than intended design.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71234
EUVD
EUVD-2026-53307

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
documize community *
documize community 5.14.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Documize Community allows unauthorized access to attachments. The attachment download route incorrectly checks for a non-empty 'secure' query parameter instead of validating it against a server-stored value. Any non-empty string like ?secure=x bypasses authentication entirely, letting attackers download attachments from any organization.

Detection Guidance

Check if the attachment download endpoint in Documize Community is accessible without proper authentication. Test by accessing URLs like /domain/attachment/endpoint?secure=x where x is any non-empty string. Verify if unauthorized attachments can be downloaded.

Impact Analysis

Attackers could exploit this to access sensitive documents without authentication. This may lead to data breaches, exposure of confidential information, or unauthorized sharing of proprietary content. The impact depends on the sensitivity of the documents stored in the system.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without proper access controls. For HIPAA, it risks unauthorized access to protected health information. Non-compliance may result in legal penalties, fines, or reputational damage due to failed security requirements.

Mitigation Strategies

Disable the insecure attachment download route or update the code to validate the secure parameter against a server-stored value. Ensure all handlers enforce session-based authorization consistently.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71234. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart