CVE-2026-85697
Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges can read restricted documents within their team or cross-tenant by leveraging missing ownership validation on document data identifiers.
Schwachstellenklasse
Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges can read restricted documents within their team or cross-tenant by leveraging missing ownership validation on document data identifiers.
Quellen
- https://github.com/documenso/documenso
- https://github.com/documenso/documenso/blob/v2.17.0/apps/remix/server/api/files/files.helpers.ts
- https://github.com/documenso/documenso/issues/3112
- https://www.vulncheck.com/advisories/documenso-2.17.0-pdf-route-ignores-document-visibility
- https://github.com/documenso/documenso/issues/3112
Finden Sie die Schwachstelle, bevor es ein Angreifer tut.
Melden Sie sich mit GitHub an und starten Sie Ihr erstes Audit in weniger als einer Minute. Für den kostenlosen Plan ist keine Kreditkarte nötig.