Which versions of TestLink are affected by CVE-2026-70561?

TestLink versions 1.9.20 and earlier contain an authorization bypass vulnerability allowing authenticated users-including guest-level accounts-to download arbitrary file attachments from projects…

How to fix or mitigate CVE-2026-70561?

Within 24 hours, inventory all TestLink installations running version 1.9.20 or earlier and audit attachments for sensitive data; review attachment download logs to identify unauthorized access patterns. Within 7 days, restrict network-layer access to the attachmentdownload.php endpoint, disable guest and low-privilege user roles in TestLink, and enforce project membership audits to ensure users access only assigned projects. Within 30 days, implement a web application firewall rule to block sequential integer ID enumeration on the attachment endpoint, migrate sensitive attachments to external storage with independently managed access controls, and establish continuous monitoring for anomalous file download activity.

TestLink CVE-2026-70561

Q: What is the CVSS score of CVE-2026-70561?

CVE-2026-70561 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-54574 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-07 VulnCheck

GHSA-wmvr-m7cj-9g8w

PHP Authentication Bypass Testlink

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable endpoint, low complexity, requires only authenticated low-privilege access (PR:L); pure confidentiality breach with no integrity or availability impact and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 19:16 vuln.today

CVE Published

Aug 07, 2026 - 18:27 cve.org

HIGH 7.1

DescriptionCVE.org

TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role authorization check. Attackers can enumerate sequential integer IDs through the attachment download endpoint to retrieve file contents from private projects they have no membership in, bypassing the per-project access control model and exposing test specifications, requirements documents, execution evidence, and other sensitive uploaded files across the entire installation.

AnalysisAI

Insecure direct object reference in TestLink 1.9.20 and earlier allows any authenticated user - including low-privilege guest accounts - to retrieve arbitrary file attachments from projects they have no membership in, by supplying sequential integer IDs to the attachmentdownload.php endpoint. The handler performs no project membership or role authorization check, enabling bulk enumeration of all attachments across the entire installation. No public exploit has been confirmed at time of analysis, though a researcher writeup exists; the attack is trivially automatable due to the sequential integer ID scheme.

Technical ContextAI

TestLink is an open-source, PHP-based web test management system used to organize test cases, requirements, and execution evidence. The vulnerable component is the attachmentdownload.php HTTP handler, which accepts a user-supplied integer attachment ID and serves the corresponding file without verifying that the authenticated session belongs to the project that owns the attachment. CWE-639 (Authorization Through User-Controlled Key) precisely describes this root cause: the application uses a user-controlled, predictably sequential integer as the sole access key for a protected resource and does not validate object-level authorization before serving it. The CPE cpe:2.3:a:testlinkopensourcetrms:testlink:*:*:*:*:*:*:*:* covers all releases through 1.9.20 per EUVD-2026-54574. Because attachment IDs are sequential integers, an attacker requires no prior knowledge of file names or project structure to systematically enumerate and retrieve every attachment in the installation.

RemediationAI

No vendor-released patch has been identified at time of analysis - the TestLink GitHub repository at https://github.com/TestLinkOpenSourceTRMS/testlink-code should be monitored for a code fix. As an immediate compensating control, administrators should disable guest account self-registration and audit existing low-trust accounts, since the attack requires at minimum a low-privilege authenticated session. The attachmentdownload.php endpoint should be restricted at the reverse proxy or web server layer to allow access only from trusted IP ranges or VPN-connected clients - this eliminates remote exploitation entirely at the cost of requiring VPN for all attachment downloads. A correct code-level fix requires adding a project membership authorization check in attachmentdownload.php that verifies the requesting user's session is associated with the project owning the queried attachment ID before serving file content. A WAF rule rate-limiting rapid sequential requests to attachmentdownload.php can slow bulk enumeration but does not prevent a patient attacker from exfiltrating attachments incrementally.