TI-2026-75438 CVE-2026-111652 · GHSA-mq27-6p96-cfjc
Missing authorization in EngineerCMS exposes project attachments
Priority HIGH 70
Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments.