---
id: CVE-2026-70561
title: >-
  TestLink 1.9.20 and prior contains an insecure direct object reference
  vulnerability that allows any authenticated user, including low-privilege
  guest accounts, to read arbitrary attachments by supplying an integer
  attachment ID to the a…
summary: >-
  TestLink 1.9.20 and prior contains an insecure direct object reference
  vulnerability that allows any authenticated user, including low-privilege
  guest accounts, to read arbitrary attachments by supplying an integer
  attachment ID to the a…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-639
vendor: TestLinkOpenSourceTRMS
product: TestLink
affected:
  - TestLink <= 1.9.20
published: '2026-08-07'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-70561'
references:
  - url: 'https://github.com/TestLinkOpenSourceTRMS/testlink-code'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/geo-chen/oss/blob/main/testlink-code.md'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/testlink-and-prior-authenticated-idor-via-attachmentdownload-php
    label: disclosure@vulncheck.com
  - url: 'https://github.com/geo-chen/oss/blob/main/testlink-code.md'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00371
epssPercentile: 0.28324
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-10T12:00:36.723895Z'
ingestedAt: '2026-09-24T15:45:56.715Z'
---

## Overview

TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role authorization check. Attackers can enumerate sequential integer IDs through the attachment download endpoint to retrieve file contents from private projects they have no membership in, bypassing the per-project access control model and exposing test specifications, requirements documents, execution evidence, and other sensitive uploaded files across the entire installation.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.