Documenso
Monthly
Documenso 2.17.0's PDF-serving endpoint fails to enforce document visibility settings or validate ownership of document data identifiers, allowing authenticated low-privilege users to retrieve restricted documents belonging to other users - including across organizational tenant boundaries. The flaw is pinned to files.helpers.ts in the Remix server layer and is tracked via VulnCheck advisory and GitHub issue #3112. No active exploitation or public exploit code is confirmed at time of analysis.
Unauthenticated file upload in Documenso before 2.13.0 exposes the /api/files/upload-pdf endpoint to any remote actor without requiring session tokens, API keys, or any credential, enabling indefinite storage exhaustion and database flooding with orphaned document records. The flaw (CWE-306, Missing Authentication for Critical Function) carries a CVSS 4.0 score of 8.7 with a confirmed AV:N/PR:N vector, meaning exploitation requires only network reachability and standard HTTP tooling. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the trivial attack complexity makes automated abuse highly plausible against self-hosted instances exposed to the internet.
Google OAuth login in Documenso through version 2.11.0 fails to enforce two-factor authentication during the OAuth callback flow, allowing a remote attacker to authenticate as any Google-linked user without completing MFA verification. The flaw resides in handle-oauth-callback-url.ts, where the oauth2fa state is not properly routed through the dedicated OAuth 2FA verification path - as confirmed by the PR diff showing the signin form was not checking the oauth2fa=true callback parameter. Publicly available exploit code exists (GitHub issue #2758), though no active exploitation has been confirmed and the CVSS 4.0 AC:H rating indicates the attack requires precise manipulation of the OAuth callback flow.
Documenso 2.17.0's PDF-serving endpoint fails to enforce document visibility settings or validate ownership of document data identifiers, allowing authenticated low-privilege users to retrieve restricted documents belonging to other users - including across organizational tenant boundaries. The flaw is pinned to files.helpers.ts in the Remix server layer and is tracked via VulnCheck advisory and GitHub issue #3112. No active exploitation or public exploit code is confirmed at time of analysis.
Unauthenticated file upload in Documenso before 2.13.0 exposes the /api/files/upload-pdf endpoint to any remote actor without requiring session tokens, API keys, or any credential, enabling indefinite storage exhaustion and database flooding with orphaned document records. The flaw (CWE-306, Missing Authentication for Critical Function) carries a CVSS 4.0 score of 8.7 with a confirmed AV:N/PR:N vector, meaning exploitation requires only network reachability and standard HTTP tooling. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the trivial attack complexity makes automated abuse highly plausible against self-hosted instances exposed to the internet.
Google OAuth login in Documenso through version 2.11.0 fails to enforce two-factor authentication during the OAuth callback flow, allowing a remote attacker to authenticate as any Google-linked user without completing MFA verification. The flaw resides in handle-oauth-callback-url.ts, where the oauth2fa state is not properly routed through the dedicated OAuth 2FA verification path - as confirmed by the PR diff showing the signin form was not checking the oauth2fa=true callback parameter. Publicly available exploit code exists (GitHub issue #2758), though no active exploitation has been confirmed and the CVSS 4.0 AC:H rating indicates the attack requires precise manipulation of the OAuth callback flow.