Documenso PDF Access Control Bypass in 2.17.0

Executive Summary

Documenso 2.17.0 has an access control flaw in its PDF-serving endpoint. The system fails to properly validate document visibility settings, allowing low-privilege users to read documents restricted to higher roles like ADMIN or MANAGER within their team. Additionally, attackers can exploit missing ownership validation on document data identifiers to access documents across different tenants.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Documenso's file-serving routes for improper access control checks. Review the checkEnvelopeFileAccess function in files.helpers.ts for missing visibility or ownership validation. Check for unauthorized access to PDF endpoints by low-privilege users or cross-tenant requests. Use Prisma queries to audit document access logs for anomalies.

Useful 0 Not Useful 0

Impact Analysis

Unauthorized users may access confidential documents they shouldn't see, including signed documents. Attackers could be low-privilege team members, former recipients with old links, or even cross-tenant actors. This risks data leaks, compliance violations, and loss of sensitive information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR's data protection principles and HIPAA's access controls, as unauthorized document access risks exposing personal or health data. Organizations using Documenso may face regulatory penalties, legal liabilities, and reputational damage due to non-compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Update Documenso to the latest patched version. Modify the checkEnvelopeFileAccess function to enforce visibility-gated logic like the tRPC layer. Bind DocumentData to owning team/envelope or validate documentDataId ownership during envelope creation. Restrict cross-tenant document access and audit existing document permissions.

Useful 0 Not Useful 0