CVE-2026-108729

Versions of Corteza up to 2024.9.10 are vulnerable to an incorrect authorization flaw in the compose attachment endpoints . This vulnerability allows unauthenticated attackers to download private attachments by manipulating the URL kind segment to values such as page, icon, or namespace. If an at...

CVE-2026-108729 Corteza through 2024.9.10 Unauthenticated Attachment Access via Compose Attachment Endpoints

Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments by setting the URL kind segment to page, icon, or namespace. Attackers who know a private record or module attachment i...

EUVD-2026-96895

Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments by setting the URL kind segment to page, icon, or namespace. Attackers who know a private record or module attachment i...