Description
R-SOFT DMS is vulnerable to Insecure Direct Object Reference (IDOR) attack in multiple file download endpoints. The application fetches files from the database by ID and serves them to whoever requests them, relying only on session authentication, meaning any valid user can access any file.

This issue was fixed in version v3.19-2862 and v3.17-2580.
Published: 2026-07-10
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

R‑SOFT DMS exposes a classic insecure direct object reference flaw where any authenticated user can supply a file identifier and download files without ownership validation. The weakness, classified as CWE‑639, allows a user to obtain confidential documents stored on the server, leading to loss of confidentiality and potential regulatory penalties if sensitive data is compromised.

Affected Systems

The vulnerability affects R‑SOFT SERWIS DMS versions prior to v3.19‑2862 and v3.17‑2580. Any installation of these releases is susceptible to IDOR exploitation.

Risk and Exploitability

The vulnerability has a CVSS score of 7.1, indicating high severity. The EPSS score of less than 1% suggests that mass exploitation is currently unlikely, and the issue is not listed in CISA’s KEV catalog. An attacker must possess a valid user session; with that access, they can modify request parameters to retrieve files belonging to other users. The description does not mention any public exploits, but the flaw enables data disclosure to any authenticated user.

Generated by OpenCVE AI on July 29, 2026 at 11:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade R‑SOFT SERWIS DMS to v3.19‑2862 or v3.17‑2580, which contain the fix for the IDOR issue.
  • Implement access control checks in the download endpoints to verify that the requesting user owns the requested file before serving it.
  • If an upgrade cannot be performed immediately, isolate file storage from the web server, remove the file ID parameter from URLs, and enforce application‑level filtering to deny access to files not within the user’s domain.

Generated by OpenCVE AI on July 29, 2026 at 11:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Jul 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared R-soft Serwis
R-soft Serwis dms
Vendors & Products R-soft Serwis
R-soft Serwis dms

Fri, 10 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Description R-SOFT DMS is vulnerable to Insecure Direct Object Reference (IDOR) attack in multiple file download endpoints. The application fetches files from the database by ID and serves them to whoever requests them, relying only on session authentication, meaning any valid user can access any file. This issue was fixed in version v3.19-2862 and v3.17-2580.
Title Insecure Direct Object Reference in R-SOFT DMS
Weaknesses CWE-639
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

R-soft Serwis Dms
cve-icon MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published:

Updated: 2026-07-10T10:23:43.264Z

Reserved: 2026-04-22T11:32:15.204Z

Link: CVE-2026-41878

cve-icon Vulnrichment

Updated: 2026-07-10T10:23:05.627Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T11:15:04Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key