HIGH
CVE-2026-71234
CVSS
7.5
Description
Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value.
Weakness (CWE)
CWE-863
Incorrect Authorization
EPSS Score
0.25%
Probability of exploitation in next 30 days
16.1th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.