Which versions of R-SOFT DMS are affected by CVE-2026-41878?

R-SOFT DMS versions prior to patched releases contain a broken authorization flaw allowing authenticated users to access files belonging to other users, creating direct exposure of sensitive…

How to fix or mitigate CVE-2026-41878?

Within 24 hours: Identify all R-SOFT DMS instances in use and determine if versions are prior to v3.19-2862 or v3.17-2580; document which systems store sensitive information. Within 7 days: Enable comprehensive audit logging on all file-download endpoints; restrict user role assignments to least-privilege scope; disable inactive user accounts; limit network access to trusted subnets only. Within 30 days: Monitor vendor communications for patch release; establish test deployment plan for patch in non-production environment; prepare production deployment schedule with change control.

R-SOFT DMS CVE-2026-41878

Q: What is the CVSS score of CVE-2026-41878?

CVE-2026-41878 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-42856 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-10 cvd@cert.pl

GHSA-m5fr-qm38-x8f3

Authentication Bypass

7.1

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable download endpoint (AV:N/AC:L), requires any authenticated account (PR:L), no user interaction; discloses other users' files (C:H) with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 10:34 vuln.today

DescriptionCVE.org

R-SOFT DMS is vulnerable to Insecure Direct Object Reference (IDOR) attack in multiple file download endpoints. The application fetches files from the database by ID and serves them to whoever requests them, relying only on session authentication, meaning any valid user can access any file.

This issue was fixed in version v3.19-2862 and v3.17-2580.

AnalysisAI

Broken object-level authorization in R-SOFT DMS lets any authenticated user download arbitrary files by manipulating the object ID in multiple file-download endpoints, since the application enforces only session authentication and never checks whether the requester owns or may access the requested file. This is an authenticated confidentiality breach (CVSS 4.0 7.1) affecting all versions prior to v3.19-2862 and v3.17-2580. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

R-SOFT DMS is a document management system that stores uploaded files in a database and serves them through download endpoints keyed by a numeric/sequential object identifier. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), a classic Insecure Direct Object Reference: the endpoint trusts the client-supplied file ID and validates only that a session is present, omitting the per-object ownership/ACL check that should tie a file to the authorized requester. Because IDs are enumerable and passed directly to the database fetch, incrementing or substituting the ID exposes other tenants'/users' documents. The vendor and reporter label this an 'Authentication Bypass,' but technically it is an authorization (access-control) flaw - authentication still functions; it is the object-level authorization that is missing.

RemediationAI

Vendor-released patch: upgrade to R-SOFT DMS v3.19-2862 (v3.19 branch) or v3.17-2580 (v3.17 branch), which add the missing object-level authorization checks; consult the CERT.PL advisory at https://cert.pl/posts/2026/07/CVE-2026-41876 for details and coordinate the exact build with R-SOFT. If patching cannot be immediate, apply compensating controls at the access layer: restrict the affected download endpoints behind a reverse proxy or WAF rule that requires per-object ownership context, disable open/self-service account registration so untrusted parties cannot obtain the low-privilege session the attack needs, and tighten monitoring for rapid sequential ID enumeration on download URLs (a high false-positive/tuning cost but effective at detecting scraping). Reducing the number of accounts and enforcing least privilege limits the blast radius, though none of these substitute for the code-level authorization fix in the patched versions.