Incorrect authorization in Corteza - #VU156188
Published: October 19, 2026
Vulnerability identifier: #VU156188
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to obtain signed download URLs for attachments they are not authorized to read.
The vulnerability exists due to apparently inverted authorization checks in the Compose attachment service's Find and List guards when evaluating attachment read permissions. A remote user can invoke the affected operations while denied read access to obtain signed download URLs that may permit unauthorized access to attachment contents.
Affected software
Corteza
Remediation
Install security update from vendor's website.
Corteza - update to 2026.9.0