ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-70561

TestLink 1.9.20 and prior Authenticated IDOR via attachmentdownload.php

CVSS 4.0 7.1 HIGHCVSS 3.1 6.5 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-70561

Published

TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role authorization check. Attackers can enumerate sequential integer IDs through the attachment download endpoint to retrieve file contents from private projects they have no membership in, bypassing the per-project access control model and exposing test specifications, requirements documents, execution evidence, and other sensitive uploaded files across the entire installation.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-70561

Published

TestLink

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "affected",
                    "vendor": "TestLinkOpenSourceTRMS",
                    "product": "TestLink",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "versionType": "semver",
                            "lessThanOrEqual": "1.9.20"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON