O2OA

Records1All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

O2OA records in CISA KEV

No O2OA vulnerabilities are listed in CISA KEV.

Records

1 record

TI-2026-75406 CVE-2026-111620 · GHSA-3hg3-468c-h77g

Authorization bypass in O2OA lets users download other users' attachments

MEDIUM 60

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00382 Published 2026-10-16 No fix listed CWE-639

Open these records in search →

Critical	0
High	0
Medium	1
Low	0
No CVSS	0