CVE-2026-71234 Documize Community: Attachment Download Authorization Bypass via Non-Validated secure Token

Documize Community's attachment download route domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware accepts a secure query parameter and grants access whenever the parameter is simply non-empty lensecureToken 0, without comparing it to any server-stor...