Vulnerability · Published Jul 10, 2026 · Assigned by CERT-PL

CVE-2026-41878Insecure Direct Object Reference in R-SOFT DMS

High 7.1

In plain English

A high-severity authorization bypass via user-controlled key in DMS from R-SOFT SERWIS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.5%top 59.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

R-SOFT DMS is vulnerable to Insecure Direct Object Reference (IDOR) attack in multiple file download endpoints. The application fetches files from the database by ID and serves them to whoever requests them, relying only on session authentication, meaning any valid user can access any file. This issue was fixed in version v3.19-2862 and v3.17-2580.

Affected products (as reported)

Vendor	Product	Versions
R-SOFT SERWIS	DMS	0 – before v3.19-28620 – before v3.17-2580

Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://cert.pl/posts/2026/07/CVE-2026-41876 third-party-advisory