CVE-2020-26176 - CVE House
Back to Database
Status published Medium CVE-2020-26176

An issue was discovered in tangro Business Workflow before 1.18.1....

Vulnerability Description

An issue was discovered in tangro Business Workflow before 1.18.1. No (or broken) access control checks exist on the /api/document/<DocumentID>/attachments API endpoint. Knowing a document ID, an attacker can list all the attachments of a workitem, including their respective IDs. This allows the attacker to gather valid attachment IDs for workitems that do not belong to them.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-26176

Credits & Attribution

No credits recorded in the NVD database.

References

More from tangro

View All →
CVE-2020-26178
In tangro Business Workflow before 1.18.1, knowing an attachment ID,...
Medium 5.3
CVE-2020-26177
In tangro Business Workflow before 1.18.1, a user's profile contains...
Medium 4.3
CVE-2020-26175
In tangro Business Workflow before 1.18.1, an attacker can manipulate...
Medium 6.5
CVE-2020-26174
tangro Business Workflow before 1.18.1 requests a list of allowed...
High 8.8
CVE-2020-26173
An incorrect access control implementation in Tangro Business Workflow before...
Low 3.1

Affected Vendor

Affected Software

business workflow
Vulnerable Versions:
0

Timeline

Official Publish: December 18th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.