O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to… (CVE-2026-111620)

The vulnerability in O2OA through version 10.0.2-ce is an authorization bypass in the x_processplatform_assemble_surface module. Specifically, the functions ActionDownloadWithWork and ActionDownloadWithWorkStream fail to verify ownership of attachments before allowing downloads. As a result, any authenticated user who knows an attachment UUID can download attachments from other users' works by requesting the resource at jaxrs/attachment/download/{id}/work/{workId}. This flaw violates access control principles and exposes sensitive documents to unauthorized users.

The vulnerability allows authenticated users to bypass authorization controls and download attachments belonging to other users' works or drafts. This leads to unauthorized disclosure of potentially sensitive documents. The CVSS score of 5.3 (medium severity) reflects the network attack vector with low privileges required but high impact on confidentiality. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restricting access to authenticated users and limiting knowledge of attachment UUIDs may reduce risk, but no definitive mitigation is confirmed.