CyberRota Analysis
AI-GeneratedThe vulnerability in Documize Community's attachment download route allows unauthorized access to any organization's attachments by accepting any non-empty `secure` query parameter, bypassing authentication checks. This flaw poses a significant risk as it enables attackers to download sensitive documents without proper authorization. Organizations using this software should prioritize patching this vulnerability to prevent potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value.