CVE-2026-71234: Documize Community

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value.

Affected products

• Documize Community: version 0 only

Published 2026-08-05. Last modified 2026-08-26.