https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T03:12:37.532235+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-71234 CVE-2026-71234 — Documize Community - Attachment Download Authorization Bypass via Non-Validated secure Token 2026-10-10T03:12:37.533407+00:00

Affected: documize community

Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value.