Authorization bypass through user-controlled key in Corteza - #VU156186
Published: October 19, 2026
Vulnerability identifier: #VU156186
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to download private Compose record attachments and disclose sensitive information.
The vulnerability exists due to authorization bypass through an attacker-controlled kind parameter in the Compose attachment-serving component when handling attachment download requests. A remote attacker can request a private attachment by its identifier with kind=page to bypass the signature check and download its contents, because the lookup does not validate the attachment's stored kind or namespace against the request.
Affected software
Corteza
Remediation
Install security update from vendor's website.
Corteza - update to 2026.9.0