Documize Community's attachment download endpoint improperly authorizes access based solely on the presence of a non-empty 'secure' query parameter, without verifying its value against any server-side token. This flaw allows unauthenticated attackers to bypass authorization controls and download attachments belonging to any organization. Related handlers in the same codebase enforce session-based authorization correctly, confirming this is an inconsistent and unintended authorization bypass vulnerability classified as CWE-863 (Incorrect Authorization).

An attacker can bypass authentication and authorization controls to download attachments from any organization hosted on the vulnerable Documize Community instance. This results in unauthorized data disclosure (confidentiality impact). There is no indication of integrity or availability impact. The CVSS score of 7.5 reflects a high severity due to network attack vector, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the attachment download endpoint through network controls or web application firewalls to prevent unauthorized access. Monitor for unusual access patterns to attachments. Avoid relying on the 'secure' query parameter for authorization.