Authorization bypass through user-controlled key in Corteza - #VU156187
Published: October 19, 2026
Vulnerability identifier: #VU156187
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to read or delete attachments without authorization.
The vulnerability exists due to missing authorization checks in the Compose attachment service's FindByID, Read, and DeleteByID operations when handling attachment access by identifier. A remote user can supply another attachment's identifier to access its contents or delete it without the intended access-control checks.
Affected software
Corteza
Remediation
Install security update from vendor's website.
Corteza - update to 2026.9.0