---
id: "CVE-2026-111620"
kind: "vulnerability"
aliases: ["CVE-2026-111620"]
title: "O2OA: authenticated users can download other users' process attachments"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["o2oa", "package", "process-platform", "self-hosted"]
not_affected_if: ["auth-required"]
published_at: "2026-10-16T18:17:41+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:05:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111620", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# O2OA: authenticated users can download other users' process attachments

O2OA through 10.0.2-ce does not check that an attachment belongs to the work named in the download request. An authenticated user who knows an attachment UUID can read documents attached to other users' processes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed O2OA version with the product's version file or admin console; versions through `10.0.2-ce` are affected
- Confirm whether the `x_processplatform_assemble_surface` service is deployed and reachable

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111620

## From the sources

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the referenced work or draft, so any visitable work or owned draft can be supplied. Attackers who know an attachment UUID can request it through jaxrs/attachment/download/{id}/work/{workId} to read documents attached to other users' processes.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_