CVE-2026-71234

Name of the Vulnerable Software and Affected Versions Documize Community (affected versions not specified)

Description An authorization bypass exists in the attachment download route. The Download() function, located in domain/attachment/endpoint.go, accepts a secure query parameter but only verifies that the parameter is not empty rather than validating it against a stored value. Consequently, providing any non-empty string in the secure parameter allows an attacker to bypass authentication and download attachments from any organization.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.