The vulnerability in O2OA 10.0.2-ce is an authorization bypass identified as CWE-639 in the attachment download service. The system does not verify that the attachment identifier actually belongs to the requested work or draft, enabling an attacker to download any attachment whose UUID is known. Defending access to attachments is essential for preserving confidentiality, and failure to enforce this check allows unauthorized disclosure of potentially sensitive documents from other users' processes.

O2OA version 10.0.2-ce is affected. The issue resides in the x_processplatform_assemble_surface component, and any instance using this version, regardless of deployment scale, is potentially vulnerable.

With a CVSS v3 score of 6, the vulnerability presents a moderate severity. EPSS data is unavailable, but the lack of an explicit protection mechanism suggests that exploitation is straightforward for authenticated users who can obtain an attachment UUID. The vulnerability is not listed in CISA KEV, indicating no confirmed widespread exploitation yet. Attackers need only an authenticated session and realistic knowledge of an attachment ID; no special system privileges are required.