This vulnerability is an insecure access control flaw in the Contact Plan, E‑Mail, SMS and Fax components of Asseco SEE Live 2.0. A remote attacker who can guess or compute the attachment URL can download and execute attachments without authentication. This grants the attacker potential read access to sensitive information or the ability to execute arbitrary code if the attachment content can be abused. The weakness is listed as CWE‑284 – Failure to Restrict the Use of One or More Privileges.

The affected product is Asseco SEE Live 2.0. Vulnerable components include Contact Plan, E‑Mail, SMS and Fax. No granular versioning is provided, but the issue applies to the 2.0 release line. No vendor‑specific product mapping or patch version is available in the data.

The CVSS base score is 9.9, indicating critical severity. EPSS is below 1 %, suggesting exploitation likelihood is low at present. It is not listed in the CISA KEV catalog. Attackers can exploit this remotely by constructing a valid URL to the attachment; authentication is not required. The vulnerability does not require local privilege escalation, so attack may be achievable from external network connections.