CVE-2026-112240

MediumCVSS 6.3/10Last modified Oct 20, 2026

Description

The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email.

Metrics

CVSS 4.0 6.3/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-338 CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Oct 20, 2026
Last modified: Oct 20, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1122419.8Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCar CVE-2026-1122428.8Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Pr CVE-2026-1122435.8The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before CVE-2026-1122445.3The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bu CVE-2026-1122474.3A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5. This CVE-2026-1122484.7A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. This impacts the function ProductImportDataObject.PreparePro CVE-2026-1122492.4A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw of the file src/Web/Grand.Web/Views/Prod CVE-2026-112256.5Inappropriate implementation in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a cra CVE-2026-1122504.4A vulnerability has been identified in BRAIN2 versions up to and including version 3.09. Under specific installation conditions, the passwor CVE-2026-1122514.3A vulnerability was detected in antoinersx clawhost up to 0.0.45. This affects the function handleRequest of the file apps/clawhostgo/src/ma CVE-2026-1122527.3A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5 CVE-2026-1122544.3A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is the function _fetch_html of the file loca