CVE-2026-108729: Incorrect Authorization in cortezaproject corteza

CVE-2026-108729 describes an incorrect authorization vulnerability in the Corteza platform up to and including version 2024.9.10. The vulnerability exists in the compose attachment endpoints, where unauthenticated attackers can download private attachments by setting the URL kind segment to page, icon, or namespace. The exploit requires knowledge of a private record or module attachment ID and allows retrieval of original or preview files without any authentication token or signature, effectively bypassing access controls across namespaces and record permissions.

This vulnerability enables unauthorized disclosure of private attachments stored in Corteza. Attackers can access sensitive files across namespace and record permission boundaries without authentication, potentially leading to data leakage of confidential information. The CVSS 4.0 score of 8.2 indicates a high severity impact with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to Corteza endpoints and monitor for suspicious access patterns. Avoid exposing attachment IDs publicly to reduce risk of exploitation.