A missing authentication check in the attachment download route allows any user who supplies a non‑empty secure token parameter to download organization attachments. The route is publicly accessible and accepts arbitrary strings for the secure parameter, bypassing all session checks. As a result, any attacker can retrieve files that are normally protected by a signed or session‑based mechanism, exposing internal documents and potentially sensitive information. This flaw manifests as a confidentiality violation rather than code execution, and the privilege escalation is achieved via a simple URL parameter tampering.

The vulnerable component resides in the open source Documize Community application. No specific version numbers are listed in the CVE data, so any installed instance of the community edition is potentially affected.

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score is not available, and the issue is not listed in the CISA KEV catalogue. With a public HTTP endpoint that offers an unauthenticated download when a query string is present, the attack vector is easy to craft and can be performed remotely by any externally reachable user. The lack of server‑side token verification removes all controls, meaning an attacker can bypass authorization with a simple HTTP GET, leading to significant exposure of confidential attachments. Given the ease of exploitation, the overall risk to affected systems remains high until mitigated.