TI-2026-49282 CVE-2026-70561 · GHSA-wmvr-m7cj-9g8w
TestLink 1.9.20 and prior Authenticated IDOR via attachmentdownload.php
Priority MEDIUM 64
TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attac…