CVE-2026-70561 affects TestLink 1.9.20 and prior. It is an insecure direct object reference vulnerability in the attachmentdownload.php handler that lacks project or role authorization checks. Authenticated users can supply arbitrary integer attachment IDs to download files from private projects they do not belong to. This bypasses the intended per-project access control model, exposing sensitive uploaded files such as test specifications, requirements documents, and execution evidence. The vulnerability allows enumeration of sequential attachment IDs to access unauthorized content.

Any authenticated user, including low-privilege guest accounts, can read arbitrary attachments from private projects without membership or authorization. This leads to unauthorized disclosure of sensitive project files and documents across the entire TestLink installation. The confidentiality of private project data is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users carefully and consider limiting attachment downloads or monitoring access patterns to detect abuse.