Description
Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| documize | community | — | — |
References
- https://github.com/documize/community third-party-advisory