{"id":"CVE-2026-111620","kind":"vulnerability","aliases":["CVE-2026-111620"],"related":[],"title":"O2OA: authenticated users can download other users' process attachments","description":"O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the referenced work or draft, so any visitable work or owned draft can be supplied. Attackers who know an attachment UUID can request it through jaxrs/attachment/download/{id}/work/{workId} to read documents attached to other users' processes.","summary":"O2OA through 10.0.2-ce does not check that an attachment belongs to the work named in the download request. An authenticated user who knows an attachment UUID can read documents attached to other users' processes.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["o2oa","package","process-platform","self-hosted"],"not_affected_if":["auth-required"],"how_to_check":"- Check the installed O2OA version with the product's version file or admin console; versions through `10.0.2-ce` are affected\n- Confirm whether the `x_processplatform_assemble_surface` service is deployed and reachable","fix":"- unknown","status":"open","published_at":"2026-10-16T18:17:41+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:05:50+00:00","updated_at":"2026-10-25T04:05:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:05:50Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"O2OA: authenticated users can download other users' process attachments","impact":"medium","summary":"O2OA through 10.0.2-ce does not check that an attachment belongs to the work named in the download request. An authenticated user who knows an attachment UUID can read documents attached to other users' processes.","category":"package","nicknames":[],"who_cares":["o2oa","self-hosted","process-platform"],"confidence":0.6,"needs_auth":"yes","worst_case":"authenticated user reads other users' process attachments","analyst_note":"Find the fixed O2OA version and vendor advisory; the NVD entry in the sources does not name a patched release.","how_to_check":"- Check the installed O2OA version with the product's version file or admin console; versions through `10.0.2-ce` are affected\n- Confirm whether the `x_processplatform_assemble_surface` service is deployed and reachable","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"O2OA deployments up to and including `10.0.2-ce` where users have accounts. Exposure depends on whether attachments on other users' works matter to your data; the sources do not name a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000566,"input_tokens":3402,"output_tokens":451,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111620':12A,15A '-2026':11A,14A '/work':122C '10.0.2':26B,61C 'actiondownloadwithwork':83C 'actiondownloadwithworkstream':85C 'allow':74C 'assembl':71C 'attach':9A,33B,49B,54B,79C,91C,114C,127C 'attack':110C 'authent':2A,44B,75C 'author':65C 'belong':34B,93C 'bypass':66C 'ce':27B,62C 'check':30B 'contain':63C 'cve':10A,13A 'document':53B,126C 'download':5A,41B,78C 'draft':99C,106C 'host':23B 'id':92C,121C 'jaxrs/attachment/download':120C 'know':47B,112C 'name':38B 'never':86C 'o2oa':1A,16B,24B,59C 'own':105C 'packag':17B 'platform':20B 'process':8A,19B,58B,131C 'process-platform':18B 'processplatform':70C 'read':52B,125C 'referenc':96C 'request':42B,90C,117C 'self':22B 'self-host':21B 'suppli':109C 'surfac':72C 'user':3A,7A,45B,57B,76C,130C 'uuid':50B,115C 'verifi':87C 'visit':102C 'vulner':67C 'work':37B,82C,97C,103C 'workid':123C 'x':69C","nicknames":[],"mitigations":[],"who_affected":"O2OA deployments up to and including `10.0.2-ce` where users have accounts. Exposure depends on whether attachments on other users' works matter to your data; the sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111620","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111620","severity":null,"published_at":"2026-10-16T18:17:41+00:00","modified_at":"2026-10-19T13:16:56+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}