# CVE-2026-41878: R-SOFT DMS IDOR in file download endpoints

Source: https://junglewise.ai/threats/cve-2026-41878-r-soft-dms-idor-in-file-download-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-41878 · Severity: info · CVSS 7.1 · Published 2026-07-10

R-SOFT DMS, a document management system, contains a security flaw that allows any logged-in user to access and download any file stored in the database. By simply changing a file ID in the web address, a user can bypass intended access controls to view sensitive documents belonging to other users or departments. This could lead to a significant breach of confidential corporate data.

Technologies: [R-SOFT SERWIS DMS](https://junglewise.ai/threats/technologies/dms). Vendors: [R-SOFT SERWIS](https://junglewise.ai/threats/vendors/r-soft-serwis).

## Quick answers

**Is CVE-2026-41878 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41878 being exploited in the wild.

**How severe is CVE-2026-41878?** Informational severity, with a CVSS score of 7.1, published 10 July 2026.

**Which products and versions are affected?** R-SOFT SERWIS DMS versions prior to v3.19-2862 and v3.17-2580.

**Is there a fix for CVE-2026-41878?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-41878 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-41878?** Check whether you run R-SOFT SERWIS DMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

R-SOFT DMS is vulnerable to an Insecure Direct Object Reference (IDOR) flaw (CWE-639) within multiple file download endpoints. The application retrieves files from the database based on a user-supplied ID but fails to perform object-level authorization checks. While the system verifies that a requester has a valid session, it does not verify if that specific user has permission to access the requested file ID. An authenticated attacker can exploit this by enumerating or guessing file IDs to download arbitrary documents from the system. The issue is resolved in versions v3.19-2862 and v3.17-2580.

## Affected products

- R-SOFT SERWIS DMS versions prior to v3.19-2862 and v3.17-2580

## Timeline

- 2026-07-10: advisory: Original advisory published by CERT.PL
- 2026-07-10: disclosed: CVE published to NVD dataset

## References

- [https://cert.pl/posts/2026/07/CVE-2026-41876](https://cert.pl/posts/2026/07/CVE-2026-41876)

## Related threats

- [R-SOFT DMS OS command injection in OCR module](https://junglewise.ai/threats/cve-2026-41880-r-soft-dms-os-command-injection-in-ocr-module)
- [R-SOFT DMS weak password hashing for superadmin credentials](https://junglewise.ai/threats/cve-2026-41879-r-soft-dms-weak-password-hashing-for-superadmin-credentials)
- [R-SOFT DMS stored XSS in file upload functionality](https://junglewise.ai/threats/cve-2026-41877-r-soft-dms-stored-xss-in-file-upload-functionality)
- [R-SOFT DMS OS command injection in konwertujAction](https://junglewise.ai/threats/cve-2026-41876-r-soft-dms-os-command-injection-in-konwertujaction)