Rocboss paopao-ce versions through 0.6.0-alpha.3 contain an insecure direct object reference in the DownloadAttachment endpoint that allows any authenticated user to request private media by supplying arbitrary content IDs. An attacker can iterate sequential post_content identifiers via the /v1/attachment endpoint and obtain signed URLs for images, videos, and other files that are meant to be private, friend‑only, or following‑only. This flaw enables the disclosure of confidential user content, violating privacy and potentially exposing sensitive data.

The affected software is Rocboss’s paopao‑ce, all releases up to and including 0.6.0‑alpha.3. No other vendors or product variants are listed as impacted.

The flaw has a CVSS score of 7.1, indicating a high severity impact if exploited. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated against the system and can perform enumeration in a short amount of time, given that the endpoint does not limit request rates. The impact is limited to data disclosure, without code execution or system compromise.