Live › vulnerability › CVE-2026-111620
Go to dashboardO2OA through 10.0.2-ce does not check that an attachment belongs to the work named in the download request. An authenticated user who knows an attachment UUID can read documents attached to other users' processes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
O2OA deployments up to and including where users have accounts. Exposure depends on whether attachments on other users' works matter to your data; the sources do not name a fixed version.
10.0.2-ceNo product ranges from the sources yet.
10.0.2-ce are affectedx_processplatform_assemble_surface service is deployed and reachableEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the referenced work or draft, so any visitable work or owned draft can be supplied. Attackers who know an attachment UUID can request it through jaxrs/attachment/download/{id}/work/{workId} to read documents attached to other users' processes.
This page as .md · .json · in your agent: get_signal("CVE-2026-111620")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.