CVE-2026-108729

20th percentile - higher than 20% of all known CVEs

Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments by setting the URL kind segment to page, icon, or namespace. Attackers who know a private record or module attachment id can request the original or preview route without a token or signature to retrieve files across namespace and record permission boundaries.

Unauthenticated attackers can access private files and attachments, leading to data leakage and confidentiality breaches. Organizations using Corteza are exposed to unauthorized access to sensitive information.

Update Corteza to a version later than 2024.9.10 if available, or apply workarounds to restrict access to attachment endpoints. Monitor logs for unusual requests to these routes.