PT-2026-116019

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x processplatform assemble surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to th...