Vulnerability Description
R-SOFT DMS is vulnerable to Insecure Direct Object Reference (IDOR) attack in multiple file download endpoints. The application fetches files from the database by ID and serves them to whoever requests them, relying only on session authentication, meaning any valid user can access any file. This issue was fixed in version v3.19-2862 and v3.17-2580.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-41878?
CVE-2026-41878 is a documented vulnerability. R-SOFT DMS is vulnerable to Insecure Direct Object Reference (IDOR) attack in multiple file download endpoints. The application fetches files from the database by ID and serves them to whoever request...
How severe is CVE-2026-41878?
CVSS scoring is not yet available for CVE-2026-41878. Check NVD for updates.
Is there a patch for CVE-2026-41878?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.