Authorization bypass through user-controlled key in Corteza - #VU156184
Published: October 19, 2026
Vulnerability identifier: #VU156184
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to read and delete file attachments belonging to otherwise inaccessible records, pages and namespaces across the instance.
The vulnerability exists due to missing object-level authorization in the Corteza Compose attachment service and its Read, Delete, Original and Preview endpoints when handling attachment identifiers supplied in requests. A remote user can submit requests referencing another workspace's attachment identifiers to retrieve attachment metadata and signed download URLs, download file contents and delete attachments without permission to access their parent resources.
Affected software
Corteza
Remediation
Install security update from vendor's website.
Corteza - update to 2026.9.0