CVE-2026-108729

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108729
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108729.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108729
Published
2026-10-11T12:19:37Z
Modified
2026-10-13T02:46:13Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Corteza through 2024.9.10 Unauthenticated Attachment Access via Compose Attachment Endpoints
Details

Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments by setting the URL kind segment to page, icon, or namespace. Attackers who know a private record or module attachment id can request the original or preview route without a token or signature to retrieve files across namespace and record permission boundaries.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108729.json"
}
References

Affected packages

Git / github.com/cortezaproject/corteza

Affected ranges

Type
GIT
Repo
https://github.com/cortezaproject/corteza
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3835dfc4ac8bd89381753f09042ad147a4502576
Fixed
3b68aa30c7261f729fcf8202f3eab9cf7d9168d3
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2024.9.10"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

2019.*
2019.10.0-rc.1
2019.12.0
2019.12.0-rc.1
2019.12.0-rc.2
2019.12.0-rc.3
2019.12.0-rc0
2019.12.1
2019.9.0-rc.1
2020.*
2020.03.0.rc.1
2020.03.0.rc.2
2020.12.0
2020.12.0-rc.1
2020.12.0-rc.2
2020.12.0-rc.3
2020.12.0-rc.4
2020.12.0-rc.5
2020.12.1
2020.12.2
2020.3.0-rc.3
2020.6.0
2021.*
2021.3.0
2021.3.0-feature-fed-update
2021.3.0-rc.1
2021.3.0-rc.2
2021.3.0-rc.3
2021.3.0-rc.4
2021.3.1
2021.3.1-feature-fed-update
2021.6.0-rc.1
2021.6.0-rc.2
2021.6.0-rc.3
2021.9.0
2021.9.0-dev.1
2021.9.0-dev.2
2021.9.0-dev.3
2021.9.0-dev.4
2021.9.0-rc.2
2021.9.0-rc.3
2021.9.0-rc.4
2021.9.1
2021.9.2
2021.9.3
2021.9.4
2021.9.4-rc.1
2021.9.5
2021.9.5-rc.1
2021.9.6-dev.1
2021.9.6-dev.2
2022.*
2022.3.0
2022.3.0-dev.1
2022.3.0-dev.2
2022.3.0-rc.1
2022.3.0-rc.2
2022.3.0-rc.3
2022.3.0-rc.4
2022.3.0-rc.5
2022.3.1
2022.9.0
2022.9.0-dev.1
2022.9.0-dev.2
2022.9.0-dev.3
2022.9.0-dev.4
2022.9.0-rc.1
2022.9.0-rc.2
2022.9.1
2022.9.1-rc.1
2022.9.2
2022.9.2-rc.1
2022.9.2-rc.2
2023.*
2023.3.0
2023.3.0-dev.2
2023.3.0-dev.3
2023.3.0-dev.4
2023.3.0-dev.5
2023.3.0-dev.5.1
2023.3.0-dev.6
2023.3.0-rc.1
2023.3.0-rc.2
2023.3.0-rc.3
2023.3.1
2023.3.1-rc.1
2023.3.2
2023.3.2-rc.1
2023.3.2-rc.2
2023.3.3
2023.3.3-rc.1
2023.3.3-rc.2
2023.3.3-rc.3
2023.3.4
2023.3.4-rc.1
2023.3.4-rc.2
2023.3.5
2023.3.5-rc.1
2023.3.5-rc.2
2023.3.6
2023.3.6-rc.1
2023.3.6-rc.2
2023.3.7
2023.3.7-rc.1
2023.3.7-rc.2
2023.3.8
2023.3.8-rc.1
2023.9.0
2023.9.0-rc.1
2023.9.0-rc.2
2023.9.0-rc.3
2023.9.0-rc.4
2023.9.1
2023.9.1-rc.1
2023.9.2
2023.9.2-rc.1
2023.9.3
2023.9.3-rc.1
2023.9.3-rc.2
2023.9.3-rc.3
2023.9.4
2023.9.4-rc.1
2023.9.5
2023.9.5-rc.1
2023.9.5-rc.2
2023.9.6
2023.9.6-rc.1
2023.9.6-rc.2
2023.9.7-rc.1
2023.9.7-rc.2
2023.9.8
2023.9.8-rc.1
2023.9.8-rc.2
2023.9.8-rc.3
2023.9.9
2023.9.9-rc.1
2023.9.9-rc.2
2023.9.9-rc.3
2023.9.9-rc.4
2023.9.9-rc.5
2024.*
2024.9.0
2024.9.1
2024.9.1-rc.1
2024.9.1-rc.2
2024.9.10-dev.2
2024.9.10-rc.1
2024.9.10-rc.2
2024.9.10-rc.3
2024.9.10-rc.4
2024.9.2
2024.9.2-dev.2
2024.9.2-rc.1
2024.9.3
2024.9.4
2024.9.5
2024.9.5-rc.1
2024.9.6
2024.9.6-dev.2
2024.9.6-rc.1
2024.9.7
2024.9.7-dev.1
2024.9.7-hotfix.1
2024.9.7-rc.1
2024.9.7-rc.2
2024.9.7-rc.3
2024.9.8
2024.9.8-dev.1
2024.9.8-dev.2
2024.9.8-rc.1
2024.9.8-rc.2
2024.9.9
2024.9.9-hotfix.1
2024.9.9-rc.1
2024.9.9-rc.2
2024.9.9-rc.3
2024.9.9-rc.4
2024.9.9-rc.5
2024.9.9-rc.6
2024.9.9-rc.7
2024.9.9-rc.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108729.json"