{"id":"CVE-2026-108729","summary":"Corteza through 2024.9.10 Unauthenticated Attachment Access via Compose Attachment Endpoints","details":"Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments by setting the URL kind segment to page, icon, or namespace. Attackers who know a private record or module attachment id can request the original or preview route without a token or signature to retrieve files across namespace and record permission boundaries.","modified":"2026-10-13T02:46:13.809894408Z","published":"2026-10-11T12:19:37.194Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108729.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108729.json"},{"type":"ADVISORY","url":"https://hackmd.io/@haind03/corteza-attachment-kind-confusion-unauth-read"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108729"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/corteza-through-2024.9.10-unauthenticated-attachment-access-via-compose-attachment-endpoints"},{"type":"FIX","url":"https://github.com/cortezaproject/corteza/commit/3b68aa30c7261f729fcf8202f3eab9cf7d9168d3"},{"type":"PACKAGE","url":"https://github.com/cortezaproject/corteza"},{"type":"ARTICLE","url":"https://github.com/cortezaproject/corteza/blob/3835dfc4ac8bd89381753f09042ad147a4502576/server/compose/rest/attachment.go#L79-L122"},{"type":"ARTICLE","url":"https://github.com/cortezaproject/corteza/blob/3835dfc4ac8bd89381753f09042ad147a4502576/server/compose/service/attachment.go#L123-L142"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/cortezaproject/corteza","events":[{"introduced":"0"},{"fixed":"3835dfc4ac8bd89381753f09042ad147a4502576"},{"fixed":"3b68aa30c7261f729fcf8202f3eab9cf7d9168d3"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2024.9.10"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["2024.9.10-rc.4","2024.9.10-rc.3","2024.9.10-rc.2","2024.9.10-rc.1","2024.9.10-dev.2","2024.9.9-hotfix.1","2024.9.9","2024.9.9-rc.8","2024.9.9-rc.7","2024.9.9-rc.6","2024.9.9-rc.5","2024.9.9-rc.4","2024.9.9-rc.3","2024.9.9-rc.2","2024.9.9-rc.1","2024.9.8","2024.9.8-rc.2","2024.9.8-rc.1","2024.9.8-dev.2","2024.9.8-dev.1","2024.9.7-hotfix.1","2024.9.7","2024.9.7-rc.3","2024.9.7-rc.2","2024.9.7-rc.1","2024.9.7-dev.1","2024.9.6","2024.9.6-rc.1","2024.9.6-dev.2","2024.9.5","2024.9.5-rc.1","2024.9.4","2024.9.3","2024.9.2","2024.9.2-rc.1","2024.9.2-dev.2","2024.9.1","2023.9.9","2024.9.1-rc.2","2024.9.1-rc.1","2024.9.0","2023.9.9-rc.5","2023.9.9-rc.4","2023.9.9-rc.3","2023.9.9-rc.2","2023.9.9-rc.1","2023.9.8","2023.9.8-rc.3","2023.9.8-rc.2","2023.9.8-rc.1","2023.9.7-rc.2","2023.9.7-rc.1","2023.9.6","2023.9.6-rc.2","2023.9.6-rc.1","2023.9.5","2023.9.5-rc.2","2023.9.5-rc.1","2023.9.4","2023.9.4-rc.1","2023.9.3","2023.9.3-rc.3","2023.9.3-rc.2","2023.9.3-rc.1","2023.9.2","2023.9.2-rc.1","2023.9.1","2023.9.1-rc.1","2023.9.0","2023.9.0-rc.4","2023.9.0-rc.3","2023.9.0-rc.2","2023.9.0-rc.1","2023.3.8","2023.3.8-rc.1","2023.3.7","2023.3.7-rc.2","2023.3.7-rc.1","2023.3.6","2023.3.6-rc.2","2023.3.6-rc.1","2023.3.5","2023.3.5-rc.2","2023.3.5-rc.1","2023.3.4","2023.3.4-rc.2","2023.3.4-rc.1","2023.3.3","2023.3.3-rc.3","2023.3.3-rc.2","2023.3.3-rc.1","2023.3.2","2023.3.2-rc.2","2023.3.2-rc.1","2023.3.1","2023.3.1-rc.1","2023.3.0","2023.3.0-rc.3","2023.3.0-rc.2","2023.3.0-rc.1","2023.3.0-dev.6","2023.3.0-dev.5.1","2023.3.0-dev.5","2023.3.0-dev.4","2023.3.0-dev.3","2023.3.0-dev.2","2022.9.2","2022.9.2-rc.2","2022.9.2-rc.1","2022.9.1","2022.9.1-rc.1","2022.9.0-rc.2","2022.9.0","2022.9.0-rc.1","2022.9.0-dev.4","2022.9.0-dev.3","2022.9.0-dev.2","2022.9.0-dev.1","2022.3.1","2022.3.0","2022.3.0-rc.5","2022.3.0-rc.4","2022.3.0-rc.3","2022.3.0-rc.2","2022.3.0-rc.1","2022.3.0-dev.2","2022.3.0-dev.1","2021.9.6-dev.2","2021.9.6-dev.1","2021.9.5","2021.9.5-rc.1","2021.9.4-rc.1","2021.9.4","2021.9.3","2021.9.2","2021.9.1","2021.9.0","2021.9.0-rc.4","2021.9.0-rc.3","2021.9.0-rc.2","2021.9.0-dev.4","2021.9.0-dev.3","2021.9.0-dev.2","2021.9.0-dev.1","2021.6.0-rc.3","2021.6.0-rc.2","2021.6.0-rc.1","2021.3.1","2021.3.0","2021.3.0-rc.4","2021.3.0-rc.3","2021.3.0-rc.2","2021.3.0-rc.1","2021.3.1-feature-fed-update","2021.3.0-feature-fed-update","2020.12.2","2020.12.1","2020.12.0","2020.12.0-rc.5","2020.12.0-rc.4","2020.12.0-rc.3","2020.12.0-rc.2","2020.12.0-rc.1","2020.6.0","2020.3.0-rc.3","2020.03.0.rc.2","2020.03.0.rc.1","2019.12.1","2019.12.0","2019.12.0-rc.3","2019.12.0-rc.2","2019.12.0-rc.1","2019.12.0-rc0","2019.10.0-rc.1","2019.9.0-rc.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108729.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}