The vulnerability CVE-2026-39616 in dFactory Download Attachments (<= 1.4.0) allows an attacker to bypass authorization controls by manipulating a user-controlled key parameter. This occurs because the access control security levels are incorrectly configured, enabling unauthorized access to download attachments. The vulnerability is confirmed published but lacks a CVSS score and vendor-provided remediation details. No evidence of active exploitation is reported.

Successful exploitation could allow unauthorized users to access or download attachments that should be restricted, potentially exposing sensitive information. The impact is limited to the affected versions of the dFactory Download Attachments plugin and depends on the deployment context and sensitivity of the attachments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin or disabling it if feasible. Monitor vendor channels for updates and apply patches promptly once available.