Vulnerability · Published Aug 17, 2026 · Assigned by VulnCheck

CVE-2026-71518Typemill < 2.26.0 Authorization Bypass via Media File Download Route

High 7.5

In plain English

A high-severity incorrect authorization in typemill from typemill. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 56.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double slashes, or percent-encoded sequences to pass role-based restriction checks while the filesystem resolves the request to the protected file, enabling unauthorized file download without credentials.

Affected products (as reported)

Vendor	Product	Versions
typemill	typemill	0 – before 2.26.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Typemill v2.26.0 Release Notes release-notes
Patch Commit patch
https://www.vulncheck.com/advisories/typemill-authorization-bypass-via-media-file-download-route third-party-advisory