Documenso EUVD-2026-71146

Requires a valid low-privilege authenticated account on the target Documenso 2.17.0 instance (PR:L per CVSS 4.0 vector). The attacker must know or enumerate document data identifiers belonging to other users or tenants; no special configuration beyond default Documenso deployment is required. Cross-tenant exploitation is explicitly described, meaning multi-tenant instances where users from different organizations share the same application are at highest risk. The impact is limited strictly to confidentiality - no document modification or deletion capability is implied. Exploitation does not require any victim interaction. Non-exploitable condition: instances where all users are mutually trusted (single-tenant, internal-only deployments with no untrusted accounts) have substantially reduced practical risk.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) is consistent with a low-complexity, network-reachable authorization bypass requiring only a valid low-privilege account, with high confidentiality impact and no integrity or availability consequence. The cross-tenant exposure potential is the key risk multiplier: in a multi-tenant deployment, one organization's authenticated user could access documents belonging to an entirely separate tenant, making this a data isolation failure rather than a simple privilege escalation. No EPSS score, KEV listing, or confirmed public exploit is present in the available data, suggesting limited exploitation activity at time of analysis. However, the straightforward nature of the flaw (low access complexity, low privilege bar, no user interaction) makes it trivially automatable once an attacker has a valid account. The 'Authentication Bypass' tag overstates the issue - authentication is still required; what is bypassed is authorization. Real-world risk is material for any Documenso deployment handling confidential contracts or sensitive business documents.

An authenticated low-privilege user on a shared Documenso 2.17.0 instance enumerates or guesses document data identifiers - which may be sequential UUIDs or otherwise discoverable - and submits direct requests to the PDF-serving endpoint. Because files.helpers.ts does not validate visibility settings or ownership, the server returns the full PDF content of documents belonging to other users or tenants without any authorization error.