Description

Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges can read restricted documents within their team or cross-tenant by leveraging missing ownership validation on document data identifiers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T15:17:48.670Z",
  "pubdate": "2026-09-04T15:17:48.670Z",
  "executiveSummary": "Documenso 2.17.0 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability within its PDF-serving endpoint.\nThe vulnerability originates from insufficient access control validation regarding document visibility settings.\nAn attacker possessing low-level privileges can bypass intended authorization constraints to retrieve restricted documents.\nThe scope of unauthorized access extends to documents within the same team or potentially across different tenants.\nThis flaw represents a significant risk to data confidentiality, as it enables unauthorized disclosure of sensitive documents by manipulating document identifiers.\nExploitation requires minimal technical expertise, as it involves exploiting the lack of server-side ownership verification during the retrieval process.\nSuccessful exploitation allows an authenticated user to gain unauthorized read access to information they are not permitted to view.",
  "technicalDetails": "The vulnerability resides in the application's PDF-serving component, specifically within the logic responsible for fetching and rendering documents based on provided identifiers.\nThe root cause is a failure to perform robust server-side ownership and authorization validation when an endpoint processes a request for a specific document identifier.\nAlthough the application maintains document visibility settings, the endpoint responsible for serving the PDF file fails to verify whether the requesting authenticated user has the necessary permissions to access the resource defined by the identifier.\nThe attack flow proceeds as follows: An authenticated low-privileged attacker identifies the target document's identifier, which may be discovered through enumeration, predictable URL patterns, or side-channel information leakage.\nThe attacker then crafts a request to the PDF-serving endpoint, substituting the legitimate document identifier with the identifier of the target restricted document.\nBecause the server-side logic solely checks that the request is authenticated without validating the relationship between the authenticated user identity and the document's access control policy, the server proceeds to process the request.\nThe application subsequently retrieves the document data from the backend storage and serves the PDF content directly to the attacker.\nThis bypasses the intended boundary of visibility settings, allowing the attacker to read documents belonging to their own team or potentially documents residing in other tenants, depending on the global scope of the identifier space.\nThe vulnerability is present in Documenso version 2.17.0.\nThe impact is a full breakdown of confidentiality regarding document content, as an attacker can systematically scrape sensitive data by iterating through document identifiers, leading to unauthorized information disclosure and non-compliance with data privacy mandates."
}