Corteza: Incorrect authorization in attachment endpoints exposes private files

Summary

Corteza up to and including 2024.9.10 contains an incorrect authorization flaw in its Compose attachment endpoints. An unauthenticated attacker who knows or obtains the ID of a private record or module attachment can request the original or preview file without a token or signature by setting the URL kind segment to page, icon or namespace. This allows files to be read across namespace and record permission boundaries, which may expose personal or business-sensitive data.

Affected

• Corteza up to and including 2024.9.10
• 2024.9.x releases are not patched
• Installations pinned to cortezaproject/corteza:latest move to 2026.9 on the next pull, pinned 2024.9 images remain vulnerable

Fixed in

• Upgrade to Corteza 2026.9 or later. The vendor changelog states that security fixes are not backported to 2024.9.
• Exact patched 2026.9.x version: Unknown.
• The changelog entry references commit 3b68aa3 and closes unauthenticated access to private record attachments; the mapping to this CVE is inferred.

Workaround

• No vendor workaround documented.
• Restrict network access to the Corteza instance (VPN or allowlist) until the upgrade is done.
• Review web server logs for requests to the attachment routes with kind set to page, icon or namespace.

Exploitation

• Not known to be exploited in the wild.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact partial.
• Not listed in the CISA KEV catalog.
• A public technical write-up exists; no public proof-of-concept repository was found.

Our recommendation

• Identify all self-hosted Corteza instances, including Docker deployments and pinned 2024.9 tags.
• Upgrade to Corteza 2026.9 or later, after testing and with a backup.
• Until then, limit access to the instance and monitor logs for unusual attachment requests.
• If files may have been exposed, assess the data impact under the revDSG (nDSG) and consider reporting obligations.
• Priority is high for internet-exposed instances or instances holding sensitive records.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• OSV record CVE-2026-108729 osv.dev
• Vulners CVE-2026-108729 vulners.com
• OpenCVE CVE-2026-108729 app.opencve.io
• Corteza 2026.9 changelog docs.cortezaproject.org
• Corteza 2024.9 changelog docs.cortezaproject.org
• VulnCheck advisory www.vulncheck.com
• Fix commit 3b68aa3 github.com
• Vulnerable code: attachment.go (REST) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:41.