Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-108729Corteza through 2024.9.10 Unauthenticated Attachment Access via Compose Attachment Endpoints

Medium 5.9

In plain English

A medium-severity incorrect authorization in corteza from cortezaproject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.3%top 78.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments by setting the URL kind segment to page, icon, or namespace. Attackers who know a private record or module attachment id can request the original or preview route without a token or signature to retrieve files across namespace and record permission boundaries.

Affected products (as reported)

Vendor	Product	Versions
cortezaproject	corteza	0 – through 2024.9.10

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://hackmd.io/@haind03/corteza-attachment-kind-confusion-unauth-read third-party-advisory
https://github.com/cortezaproject/corteza/blob/3835dfc4ac8bd89381753f09042ad147a4502576/server/compose/rest/attachment.go#L79-L122 technical-description
https://github.com/cortezaproject/corteza/blob/3835dfc4ac8bd89381753f09042ad147a4502576/server/compose/service/attachment.go#L123-L142 technical-description
https://github.com/cortezaproject/corteza/commit/3b68aa30c7261f729fcf8202f3eab9cf7d9168d3 patch
https://github.com/cortezaproject/corteza product
VulnCheck Advisory: Corteza through 2024.9.10 Unauthenticated Attachment Access via Compose Attachment Endpoints third-party-advisory