CVE-2026-70561 Details
Description
TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role authorization check. Attackers can enumerate sequential integer IDs through the attachment download endpoint to retrieve file contents from private projects they have no membership in, bypassing the per-project access control model and exposing test specifications, requirements documents, execution evidence, and other sensitive uploaded files across the entire installation.
A vulnerability allowing insecure direct object reference has been identified in TestLink versions through 1.9.20. This vulnerability allows any authenticated user, including those with low-privilege guest accounts, to access arbitrary attachments. The issue arises because the attachmentdownload.php handler does not perform any project or role authorization checks before delivering file contents. Exploitation involves supplying an integer attachment ID, which can be sequentially enumerated to retrieve files from private projects, bypassing access controls and exposing sensitive documents across the installation.
Users are advised to upgrade to TestLink version 1.9.21 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 7, 2026CISA-ADP
Assessed Aug 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/geo-chen/oss/blob/main/testlink-code.md | CISA-ADP | ExploitTechnical Description |
| https://github.com/geo-chen/oss/blob/main/testlink-code.md | [email protected] | ExploitTechnical Description |
| https://github.com/TestLinkOpenSourceTRMS/testlink-code | [email protected] | Source CodeVendor |
| https://www.vulncheck.com/advisories/testlink-and-prior-authenticated-idor-via-attachmentdownload-php | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TestLink | <= 1.9.20 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | New CVE Received | [email protected] |