EUVD-2026-68128
GHSA-qm54-2jq3-88j9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fully network-accessible with no authentication required (AV:N, PR:N, UI:N); impact is confined to availability exhaustion only with no scope change (C:N, I:N, A:H, S:U).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.
AnalysisAI
Unauthenticated file upload in Documenso before 2.13.0 exposes the /api/files/upload-pdf endpoint to any remote actor without requiring session tokens, API keys, or any credential, enabling indefinite storage exhaustion and database flooding with orphaned document records. The flaw (CWE-306, Missing Authentication for Critical Function) carries a CVSS 4.0 score of 8.7 with a confirmed AV:N/PR:N vector, meaning exploitation requires only network reachability and standard HTTP tooling. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The /api/files/upload-pdf endpoint must be reachable over the network - no authentication, session token, or API credential is required (CVSS PR:N, UI:N confirms zero authentication prerequisite). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 is well-calibrated for this class of flaw: the network-accessible, zero-prerequisite attack with high availability impact justifies the rating, and the confirmed VC:N/VI:N metrics correctly scope the impact to denial-of-service only - there is no data exfiltration or code execution path here. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Documenso to version 2.13.0 or later, which adds the missing authentication enforcement to the /api/files/upload-pdf endpoint per the fix commit at https://github.com/documenso/documenso/commit/4f346d3c2d5264f221e4d787e162f16051e44114. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all Documenso deployments and identify instances running versions below 2.13.0, prioritizing internet-exposed self-hosted instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Documenso 2.17.0's PDF-serving endpoint fails to enforce document visibility settings or validate ownership of document
Google OAuth login in Documenso through version 2.11.0 fails to enforce two-factor authentication during the OAuth callb
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today