---
id: CVE-2026-108729
title: >-
  Corteza through 2024.9.10 contains an incorrect authorization vulnerability in
  compose attachment endpoints that allows unauthenticated attackers to download
  private attachments by setting the URL kind segment to page, icon, or
  namespace…
summary: >-
  Corteza through 2024.9.10 contains an incorrect authorization vulnerability in
  compose attachment endpoints that allows unauthenticated attackers to download
  private attachments by setting the URL kind segment to page, icon, or
  namespace…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-863
published: '2026-10-11'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T13:17:16.750'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108729'
references:
  - url: 'https://github.com/cortezaproject/corteza'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/cortezaproject/corteza/blob/3835dfc4ac8bd89381753f09042ad147a4502576/server/compose/rest/attachment.go#L79-L122
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/cortezaproject/corteza/blob/3835dfc4ac8bd89381753f09042ad147a4502576/server/compose/service/attachment.go#L123-L142
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/cortezaproject/corteza/commit/3b68aa30c7261f729fcf8202f3eab9cf7d9168d3
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@haind03/corteza-attachment-kind-confusion-unauth-read'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/corteza-through-2024.9.10-unauthenticated-attachment-access-via-compose-attachment-endpoints
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-11T13:51:17.030Z'
---

## Overview

Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments by setting the URL kind segment to page, icon, or namespace. Attackers who know a private record or module attachment id can request the original or preview route without a token or signature to retrieve files across namespace and record permission boundaries.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.