Description
R-SOFT DMS is vulnerable to Insecure Direct Object Reference (IDOR) attack in multiple file download endpoints. The application fetches files from the database by ID and serves them to whoever requests them, relying only on session authentication, meaning any valid user can access any file. This issue was fixed in version v3.19-2862 and v3.17-2580.
References (1)
Core 1
Core References
Third Party Advisory third-party-advisory
https://cert.pl/posts/2026/07/CVE-2026-41876
Scores
CVSS v4
7.1
EPSS
0.0029
EPSS Percentile
21.6%
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-639
Status
published
Products (2)
R-SOFT SERWIS/DMS
< v3.17-2580
R-SOFT SERWIS/DMS
< v3.19-2862
Published
Jul 10, 2026
Tracked Since
Jul 10, 2026