CVE-2026-111652: Engineercms Authorization Bypass Vulnerability

CVE-2026-111652 Overview

CVE-2026-111652 is a missing authorization vulnerability in Engineercms versions through 2.0.5. The flaw resides in the AttachController.Attachment handler, which serves attachment files before performing any access control checks. Unauthenticated attackers can retrieve project image and video attachments by requesting known or derived /attachment/* paths for .jpg, .png, .bmp, or .mp4 files. The controller bypasses the casbin policy engine as well as owner and administrator verification routines. The weakness is tracked under CWE-862: Missing Authorization.

Critical Impact

Unauthenticated remote attackers can download confidential project images and videos from Engineercms deployments without authentication, exposing internal engineering documentation.

Affected Products

• Engineercms versions through 2.0.5
• The AttachController.Attachment handler in controllers/attachment.go
• Any Engineercms deployment serving .jpg, .png, .bmp, or .mp4 attachments

Discovery Timeline

• 2026-10-16 - CVE-2026-111652 published to NVD
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-111652

Vulnerability Analysis

Engineercms is an open-source engineering content management system written in Go. The AttachController.Attachment route handles file retrieval for project attachments. According to the HackMD authorization analysis, the handler inspects the requested file extension early in its execution path. When the extension matches .jpg, .png, .bmp, or .mp4, the controller streams the file directly from disk and returns before reaching the casbin policy evaluator or the owner and administrator permission checks.

This short-circuit logic was likely introduced to accelerate thumbnail and preview rendering. The practical outcome is that any attacker who can reach the application over the network can download image and video attachments without authentication. Project data stored in Engineercms often contains engineering drawings, site photographs, and recorded meetings, so the exposure is substantive.

Root Cause

The root cause is the ordering of logic inside AttachController.Attachment. The relevant lines are visible in the GitHub Go code snippet at line 1705-1706 of attachment.go. File serving executes before authorization enforcement, violating the principle that access control decisions must precede resource delivery.

Attack Vector

Exploitation requires only HTTP access to the Engineercms instance. An attacker enumerates or guesses attachment paths under /attachment/ with one of the four permitted extensions. Sequential identifiers, predictable project slugs, and leaked filenames all facilitate enumeration. No credentials, user interaction, or elevated privileges are required.

No verified public exploit code is available. See the VulnCheck security advisory for additional technical context.

Detection Methods for CVE-2026-111652

Indicators of Compromise

• Unauthenticated HTTP GET requests to /attachment/* paths ending in .jpg, .png, .bmp, or .mp4
• Sequential or scripted enumeration patterns against attachment identifiers from a single source IP
• Access log entries for attachment downloads with no preceding authentication session cookie

Detection Strategies

• Review web server and reverse proxy logs for /attachment/ requests that lack an authenticated session identifier
• Correlate high-volume attachment retrieval against known user activity to surface automated scraping
• Alert on user-agents associated with scanners or scripted HTTP clients hitting attachment endpoints

Monitoring Recommendations

• Enable verbose access logging for the Engineercms application tier and forward logs to a central analytics platform
• Baseline normal attachment access volume per user and per source IP, and flag deviations
• Monitor outbound bandwidth from the Engineercms host for anomalous spikes consistent with bulk file exfiltration

How to Mitigate CVE-2026-111652

Immediate Actions Required

• Restrict network exposure of Engineercms instances to trusted networks or VPN until a patched release is deployed
• Place the application behind a reverse proxy that enforces authentication at the perimeter for all /attachment/* requests
• Audit existing attachment contents and rotate any sensitive material that may have been exposed

Patch Information

No fixed version is identified in the NVD record at the time of publication. Monitor the Engineercms GitHub repository for a release that moves the casbin, owner, and administrator checks ahead of file streaming in AttachController.Attachment. The VulnCheck security advisory tracks remediation status.

Workarounds

• Deploy a web application firewall rule that requires a valid session cookie for any request matching /attachment/.*\.(jpg|png|bmp|mp4)$
• Modify the deployment to disable public access to the /attachment/ route and serve previews only through an authenticated proxy endpoint
• Rename or relocate the attachment storage directory and update application configuration to break trivial path enumeration

# Example nginx rule to require authenticated session for attachment routes
location ~* ^/attachment/.*\.(jpg|png|bmp|mp4)$ {
    if ($http_cookie !~* "session_id=") {
        return 401;
    }
    proxy_pass http://engineercms_backend;
}