Technical impact
A documented flaw in the Documize Community attachment download routine permits any user to obtain files if they supply a non‑empty secure token in the query string, because the endpoint is registered with no authentication middleware and the token is never validated against a server‑stored value. The public download route accepts arbitrary string values for the secure parameter, thereby bypassing session or token checks and allowing the attacker to retrieve organization attachments that should be protected. This results in a confidentiality breach rather than code execution, and the vulnerability is exploitable through a simple HTTP GET request.
Affected Systems
The vulnerable component resides in the open source Documize Community application. No specific version numbers are listed in the CVE data, so any installed instance of the community edition is potentially affected.
Risk and Exploitability
The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score of 0.00316 demonstrates an extremely low exploitation probability, and the issue is not listed in the CISA KEV catalogue. With a public HTTP endpoint that offers an unauthenticated download when a query string is present, the attack vector is easy to craft and can be performed remotely by any externally reachable user. The lack of server‑side token verification removes all controls, meaning an attacker can bypass authorization with a simple HTTP GET, leading to significant exposure of confidential attachments. Given the low EPSS score, the overall risk to affected systems remains high until mitigated.
