CVE-2026-111652 Details

A missing authorization vulnerability has been identified in Engineercms versions through 2.0.5, specifically within the AttachController.Attachment handler. This vulnerability allows unauthenticated users to download project-related image and video attachments. The issue arises because the handler serves files from the '/attachment/*' path without applying necessary authorization checks, such as Casbin ACL, owner verification, or login requirements. As a result, attackers can exploit this flaw to access sensitive project materials that belong to other users.

The vulnerability can be fixed by adding the same authorization checks that are applied in the default branch of the Attachment handler. This includes enforcing Casbin permissions, project ownership, and admin rights before serving image and video files. Additionally, the '/attachment' route should be included in the authentication filter to ensure that a valid session is required for access.