Executive brief
R-SOFT DMS, a document management system, contains a security flaw that allows any logged-in user to access and download any file stored in the database. By simply changing a file ID in the web address, a user can bypass intended access controls to view sensitive documents belonging to other users or departments. This could lead to a significant breach of confidential corporate data.
Technical details
R-SOFT DMS is vulnerable to an Insecure Direct Object Reference (IDOR) flaw (CWE-639) within multiple file download endpoints. The application retrieves files from the database based on a user-supplied ID but fails to perform object-level authorization checks. While the system verifies that a requester has a valid session, it does not verify if that specific user has permission to access the requested file ID. An authenticated attacker can exploit this by enumerating or guessing file IDs to download arbitrary documents from the system. The issue is resolved in versions v3.19-2862 and v3.17-2580.
Affected products
- R-SOFT SERWIS DMS versions prior to v3.19-2862 and v3.17-2580
Timeline
- 2026-07-10: advisory: Original advisory published by CERT.PL
- 2026-07-10: disclosed: CVE published to NVD dataset