Engineercms through version 2.0.5 contains a missing authorization flaw in the AttachController.Attachment handler that allows any unauthenticated user to download project image and video files. Attackers can request known or derived URLs under the /attachment/* pattern for .jpg, .png, .bmp, or .mp4 files; the request bypasses casbin, owner, and admin checks before the file is served. This results in nondisclosure of potentially sensitive media and can expose confidential project content to external actors.

The vulnerable component is Engineercms, produced by 3xxx, affecting all releases up to and including 2.0.5. Users running Engineercms 2.0.5 or earlier are at risk if the application is exposed to unauthenticated traffic.

The CVSS score of 6.9 indicates a medium severity vulnerability with a medium exploitability score. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The exploit is straightforward: any attacker capable of sending HTTP GET requests to the target can download the files without needing credentials, making it a network‑based attack with high potential impact on confidentiality.