Authorization bypass in O2OA lets users download other users' attachments
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
O2OA through 10.0.2-ce contains an authorization bypass in the x_processplatform_assemble_surface component. An authenticated user can download attachments belonging to other users' works, because the attachment download endpoint never checks that the attachment belongs to the referenced work (CWE-639). An attacker who knows an attachment UUID can read documents attached to other users' processes. CISA's SSVC data lists a proof-of-concept exploit and marks the flaw as not automatable.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the referenced work or draft, so any visitable work or owned draft can be supplied. Attackers who know an attachment UUID can request it through jaxrs/attachment/download/{id}/work/{workId} to read documents attached to other users' processes.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for O2OA.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111620
- 2026-10-16 Alias added: GHSA-3hg3-468c-h77g
- 2026-10-18 Priority changed: MEDIUM → LOW
- 2026-10-19 CISA SSVC decision points changed
- 2026-10-19 Priority changed: LOW → MEDIUM
References
Advisory 1
Other 3
- https://github.com/o2oa/o2oa/blob/10.0.2-ce/o2server/x_processplatform_assemble_surface/src/main/java/com/x/processplatform/assemble/surface/jaxrs/attachment/ActionDownloadWithWork.java#L44-L95
- https://github.com/o2oa/o2oa/blob/10.0.2-ce/o2server/x_processplatform_assemble_surface/src/main/java/com/x/processplatform/assemble/surface/jaxrs/attachment/ActionDownloadWithWorkStream.java#L45-L64
- https://github.com/o2oa/o2oa
Sources
- CVE-2026-111620 · CVE Program
- CVE-2026-111620 · NVD
- FIRST EPSS
- GHSA-3hg3-468c-h77g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences