CVE-2026-111620
O2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint
O2OA O2OA
CVSS
6.0MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 19 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 21% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the referenced work or draft, so any visitable work or owned draft can be supplied. Attackers who know an attachment UUID can request it through jaxrs/attachment/download/{id}/work/{workId} to read documents attached to other users' processes.
Text from CVE List
Affected versions 1
- O2OAaffected: all versions through 10.0.2-ceCVE List
References 5
- vulncheck.com/advisories/o2oa-through-10.0.2-ce-cross-work-attachment-read-via-attachment-download-endpointAdvisoryvia CVE List
- hackmd.io/@hieuPenguinnn/o2oa-processplatform-attachment-download-work-cross-work-idorExploitvia CVE List
- github.com/o2oa/o2oa/blob/10.0.2-ce/o2server/x_processplatform_assemble_surface/src/main/java/com/x/processplatform/assemble/surface/jaxrs/attachment/ActionDownloadWithWork.java#L44-L95Referencevia CVE List
- github.com/o2oa/o2oa/blob/10.0.2-ce/o2server/x_processplatform_assemble_surface/src/main/java/com/x/processplatform/assemble/surface/jaxrs/attachment/ActionDownloadWithWorkStream.java#L45-L64Referencevia CVE List
- github.com/o2oa/o2oaReferencevia CVE List