CVE-2026-111620

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in xprocessplatformassemblesurface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the...

CVE-2026-111620

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in xprocessplatformassemblesurface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the...

CVE-2026-111620

O2OA versions up to and including 10.0.2-ce are vulnerable to an authorization bypass (CWE-639) in the x_processplatform_assemble_surface component. The vulnerability exists because the ActionDownloadWithWork and ActionDownloadWithWorkStream functions fail to verify if a requested attachment ID b...

EUVD-2026-103042

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in xprocessplatformassemblesurface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the...

PT-2026-116019

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x processplatform assemble surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to th...