Skip to content
Heist/ feed
Medium

O2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint

Type: advisorySource: Official CVE List1 source record

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the referenced work or draft, so any visitable work or owned draft can be supplied. Attackers who know an attachment UUID can request it through jaxrs/attachment/download/{id}/work/{workId} to read documents attached to other users' processes.

Announced Source revision 1
Original source ↗

CVE-2026-111620

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-111620

O2OA

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://github.com/o2oa/o2oa",
    "vendor": "O2OA",
    "product": "O2OA",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "10.0.2-ce"
      }
    ],
    "packageURL": "pkg:github/o2oa/o2oa",
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-111620

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#38837 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement