Auth bypass in R-soft Serwis Dms
CVE-2026-41878
R-SOFT DMS is vulnerable to Insecure Direct Object Reference (IDOR) attack in multiple file download endpoints. The application fetches files from the database by ID and serves them to whoever requests them, relying only on session authent…
Vulnerability class: IDOR (Insecure Direct Object Reference)
Affected products
- R-soft Serwis Dms — versions 0
Weakness classification (CWE)
References
- cvd@cert.pl (third-party-advisory)