Corteza CVE-2026-108729

Exploitation requires that the attacker know a valid private attachment ID (a Corteza record or module compose attachment id) and then request the original or preview serving route with the URL 'kind' path segment set to a public kind - 'page', 'icon', or 'namespace' - which causes the isAccessible() logic to treat the request as a public-kind attachment and skip the token/signature verification that would normally gate the private file. No authentication, token, or signature is needed (PR:N) and no user interaction is involved. The principal limiting factor, reflected as AT:P in the CVSS 4.0 vector, is that the attachment id must be known or guessed (Corteza uses large uint64 identifiers, so blind enumeration is non-trivial); exploitation is further limited to Corteza deployments at or below version 2024.9.10 that expose the compose attachment endpoints.

The vendor-supplied CVSS 4.0 base score of 8.2 (High) is driven by a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N) path to high confidentiality impact (VC:H) with no user interaction, tempered only by Attack Requirements being present (AT:P). That AT:P is the key nuance: exploitation is not fully spray-and-pray because the attacker must know a valid private attachment ID, which the description explicitly states ('Attackers who know a private record or module attachment id...'). The source diff confirms the root cause - isAccessible() trusted the request-supplied 'kind' segment instead of the stored attachment's kind, so declaring kind=page/icon/namespace skipped the signature check entirely - making this a confirmed, well-understood authorization flaw (CWE-863) rather than a speculative one. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public exploit was flagged, so there is no evidence of active or widespread exploitation at this time. On balance this is a genuine priority for any organization actually running Corteza (unauthenticated cross-tenant data disclosure with a vendor patch available), but the real-world blast radius is constrained by the need to know/guess attachment IDs and by Corteza's relatively limited deployment footprint, so it is less urgent than a comparable flaw in ubiquitous software.

An unauthenticated attacker who has learned a private attachment ID (for example a record or module attachment belonging to another namespace) sends a GET to the compose attachment original or preview route while setting the URL kind segment to 'page', 'icon', or 'namespace'. Because the vulnerable code validated access against the attacker-controlled kind rather than the attachment's stored kind, the signature/token check is skipped and the private file is returned, crossing namespace and record permission boundaries. No public exploit was flagged in the input, though a detailed technical write-up (hackmd) describing the kind-confusion technique is referenced.