CVE-2026-41878: R-SOFT DMS Auth Bypass Vulnerability

CVE-2026-41878 Overview

CVE-2026-41878 is an Insecure Direct Object Reference (IDOR) vulnerability affecting R-SOFT DMS, a document management system. Multiple file download endpoints fetch files from the database by identifier and return them to any authenticated caller. The application relies solely on session authentication and performs no per-object authorization check. As a result, any valid user can retrieve any file stored in the system by iterating or guessing file identifiers. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key and was fixed in versions v3.19-2862 and v3.17-2580.

Critical Impact
Any authenticated R-SOFT DMS user can download arbitrary documents belonging to other users or tenants, leading to full confidentiality loss of stored files.

Affected Products

R-SOFT DMS versions prior to v3.19-2862 on the 3.19 branch
R-SOFT DMS versions prior to v3.17-2580 on the 3.17 branch
All file download endpoints that resolve documents by database identifier

Discovery Timeline

2026-07-10 - CVE-2026-41878 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-41878

Vulnerability Analysis

R-SOFT DMS exposes several HTTP endpoints that serve stored documents for download. Each endpoint accepts a file identifier as a request parameter and returns the corresponding file content. The application authenticates the caller through the session cookie but never verifies whether that user owns or is entitled to the requested document. Because file identifiers are integers stored in the database, an attacker with a low-privilege account can enumerate identifiers sequentially and retrieve every document.

The vulnerability class, IDOR, is defined in CWE-639 as authorization bypass through a user-controlled key. Exploitation requires only network access to the application and a valid session, and it produces no obvious anomaly in application logs beyond a higher-than-normal download volume from a single account. Additional analysis of the R-SOFT DMS advisory set is available in the CERT Poland CVE-2026-41876 Analysis, which covers the same product family.

Root Cause

The root cause is missing object-level authorization. The download handlers perform the equivalent of SELECT * FROM files WHERE id = :id and stream the result to the client. They do not join against an access control list, check document ownership, or enforce tenant boundaries. Session authentication is treated as sufficient authorization, which is the pattern flagged by OWASP API1:2023 Broken Object Level Authorization.

Attack Vector

An attacker registers or compromises any valid R-SOFT DMS account. The attacker then issues authenticated HTTP requests to the vulnerable download endpoints while incrementing the file identifier parameter. Each successful response returns the raw file content, regardless of the intended recipient. Automated enumeration can exfiltrate the entire document store in a short period. No user interaction from the victim is required.

No verified public exploit code is available for CVE-2026-41878. The mechanism is described in prose because synthetic exploit code is not warranted for a straightforward parameter-tampering flaw.

Detection Methods for CVE-2026-41878

Indicators of Compromise

High request volume to file download endpoints from a single authenticated session within a short time window
Sequential or non-contiguous file identifier values requested by one account across many documents
Download activity from accounts that historically accessed only a small set of documents
HTTP 200 responses to download endpoints for file identifiers the requesting user never uploaded or was assigned

Detection Strategies

Instrument the application to log the requesting user identifier, the file identifier, and the document owner for every download request, then alert when they diverge
Deploy a web application firewall rule that flags rapid, monotonic increments of the file identifier parameter on download endpoints
Baseline normal per-user download rates and generate alerts on statistical outliers
Correlate authentication logs with download logs to identify accounts that download documents outside their business role or department

Monitoring Recommendations

Forward application access logs to a centralized SIEM and retain them long enough to support retroactive hunts once the patch is applied
Monitor egress volume from the R-SOFT DMS host for unexpected spikes that may indicate bulk exfiltration
Review privileged and service accounts for unexpected use of file download endpoints

How to Mitigate CVE-2026-41878

Immediate Actions Required

Upgrade R-SOFT DMS to v3.19-2862 or v3.17-2580, depending on the deployed branch
Review application access logs for anomalous download activity dating back to the earliest available retention window
Rotate any credentials, tokens, or secrets known to have been stored as documents in R-SOFT DMS if abuse is suspected
Restrict network access to the R-SOFT DMS web interface to trusted networks until the patch is applied

Patch Information

The vendor fixed CVE-2026-41878 in R-SOFT DMS v3.19-2862 and v3.17-2580. The fix adds server-side authorization checks so that download endpoints verify the requesting user has rights to the file identified in the request. Administrators should apply the version corresponding to their current branch and validate that download endpoints reject requests for documents the caller does not own.

Workarounds

If patching is not immediately possible, place the application behind a reverse proxy that enforces per-user allow-lists of file identifiers where feasible
Reduce the number of active accounts and disable self-registration to limit the population that can reach the vulnerable endpoints
Enable verbose access logging on download endpoints so any exploitation attempt is recorded for later investigation

bash

# Example: reverse proxy access log format capturing user and file id
log_format dms_audit '$remote_addr $remote_user [$time_local] '
                    '"$request" $status $body_bytes_sent '
                    'file_id=$arg_id session=$cookie_SESSIONID';
access_log /var/log/nginx/rsoft_dms_audit.log dms_audit;