Threats affecting pkg:github/o2oa/o2oa

O2OA versions up to 10.0.2-ce have an authorization bypass vulnerability in the x_processplatform_assemble_surface component. Authenticated users can exploit this flaw to download attachments from other users' works by supplying any attachment UUID without proper ownership verification. This issue arises because the functions ActionDownloadWithWork and ActionDownloadWithWorkStream do not verify that the requested attachment ID belongs to the referenced work or draft. The vulnerability allows unauthorized reading of documents attached to other users' processes.

A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /x_general_assemble_control/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-7292 is a medium severity vulnerability in o2oa version 10.0 affecting the syncFile function in the NodeAgent component. It allows improper authorization, potentially enabling unauthorized remote actions. The attack complexity is high and exploitability is difficult. Although the exploit has been publicly disclosed, there are no known exploits in the wild. The vendor has not yet responded or provided a patch or mitigation guidance.

A weakness has been identified in o2oa up to 10.0. This affects the function FileAction of the file FileAction.java of the component URL Fetching. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was identified in O2OA up to 9.0.0. This impacts an unknown function of the file /x_program_center/jaxrs/mpweixin/check of the component HTTP POST Request Handler. The manipulation leads to xml external entity reference. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.