CVE-2026-71234 — Documize Community - Attachment Download Authorization Bypass via Non-Validated secure Token

CVE-2026-71234

Documize Community - Attachment Download Authorization Bypass via Non-Validated secure Token PUBLISHED

Description (CNA)

Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value.

Affected (CNA)

Vendor / product	Versions
documize / community	affected 0

CWE

CWE-863

References

https://github.com/documize/community

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.