PT-2026-83401

CVE-2026-19430

·

Published

2026-08-29

·

Updated

2026-08-30

Description by

CVSS 3.1
5.3
Medium
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Catfolders Document Gallery Pro versions prior to 2.0.7
Description Certain REST API routes lack proper authorization, and the token used to identify requested content can be forged on the client side. This allows unauthenticated users to list and download the contents of folders that have not been published on the site. The issue specifically involves the download-all functionality.
Recommendations Update Catfolders Document Gallery Pro to version 2.0.7 or later.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-862: Missing Authorization
Related identifiers
CVE-2026-19430
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com