CVE-2026-70561: TestLink Auth Bypass Vulnerability

CVE-2026-70561 Overview

CVE-2026-70561 is an Insecure Direct Object Reference [CWE-639] vulnerability in TestLink 1.9.20 and prior. The flaw resides in the attachmentdownload.php handler, which accepts an integer attachment ID without enforcing project or role authorization. Any authenticated user, including low-privilege guest accounts, can enumerate sequential IDs to retrieve arbitrary attachments across the installation. The vulnerability bypasses TestLink's per-project access control model and exposes test specifications, requirements documents, execution evidence, and other sensitive uploaded files from private projects the attacker has no membership in.

Critical Impact
Authenticated attackers can read arbitrary attachments across every project by iterating attachment IDs, exfiltrating confidential test and requirements data organization-wide.

Affected Products

TestLink 1.9.20
All prior TestLink versions
Installations exposing attachmentdownload.php to authenticated users

Discovery Timeline

2026-08-07 - CVE-2026-70561 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-70561

Vulnerability Analysis

TestLink is an open-source test management application that organizes test cases, requirements, and execution evidence into projects with role-based access. Users are granted permissions on a per-project basis, and non-members should not be able to read another project's uploaded files. The attachmentdownload.php endpoint breaks this model. It accepts an integer id parameter identifying an attachment record and returns the associated file contents to any authenticated session, without checking whether the requesting user belongs to the project that owns the attachment.

Because attachment identifiers are sequential integers, an attacker with valid credentials can iterate through the numeric space and retrieve every file uploaded to the installation. The impact is confidentiality loss across all projects; integrity and availability are not directly affected.

Root Cause

The root cause is a missing authorization check on the attachment retrieval path. The handler resolves the attachment record and streams the file back based solely on the supplied ID. It does not evaluate the caller's project membership or role against the attachment's parent object, which is the exact condition described by CWE-639: Authorization Bypass Through User-Controlled Key.

Attack Vector

Exploitation requires only network access to the TestLink instance and a low-privilege authenticated session, which includes guest accounts on installations that permit self-registration. The attacker issues repeated GET requests to attachmentdownload.php supplying incrementing integer IDs. Each response either returns the file contents or an error, allowing the attacker to script enumeration and bulk-download the entire attachment corpus. See the VulnCheck Advisory on TestLink for additional technical detail.

No verified proof-of-concept code has been published. The vulnerability mechanism is described in prose because no realCodeExamples were provided in the source data.

Detection Methods for CVE-2026-70561

Indicators of Compromise

High-volume GET requests to attachmentdownload.php from a single authenticated session with sequentially incrementing id values.
Attachment downloads originating from user accounts that have no membership in the projects owning the retrieved files.
Guest or low-privilege accounts generating outbound file transfers disproportionate to their assigned role.

Detection Strategies

Parse TestLink web server access logs for requests to attachmentdownload.php and correlate the authenticated user against the project owning each attachment ID.
Alert on any session that requests more than a small threshold of distinct attachment IDs within a short window.
Baseline normal attachment access patterns per role and flag deviations, particularly from guest tier accounts.

Monitoring Recommendations

Forward TestLink and reverse-proxy logs to a central SIEM for retention and correlation with authentication events.
Monitor for enumeration signatures such as monotonic id parameter progression against any application endpoint.
Review PHP application logs for unusual concentrations of successful attachment retrievals tied to a single account.

How to Mitigate CVE-2026-70561

Immediate Actions Required

Restrict network access to the TestLink instance to trusted users and networks until a patched build is deployed.
Disable self-registration and audit existing low-privilege and guest accounts, removing any that are unnecessary.
Rotate credentials for accounts that may have been used to enumerate attachments and review recent access logs.

Patch Information

No fixed version is identified in the enriched NVD data at the time of publication. Monitor the GitHub TestLink Repository and the VulnCheck Advisory on TestLink for an official update, and upgrade beyond version 1.9.20 once a corrected release is available. Additional technical context is maintained in the GitHub TestLink Documentation.

Workarounds

Place TestLink behind an authenticating reverse proxy that restricts access to project members only, blocking unauthenticated and guest sessions from reaching attachmentdownload.php.
Apply a web application firewall rule that rate-limits requests to attachmentdownload.php and blocks sequential id enumeration patterns.
Temporarily remove or restrict the attachmentdownload.php endpoint at the web server level if attachment downloads are not business-critical.

bash

# Example nginx configuration to restrict and rate-limit the vulnerable endpoint
limit_req_zone $binary_remote_addr zone=tl_dl:10m rate=5r/m;

location = /lib/attachments/attachmentdownload.php {
    limit_req zone=tl_dl burst=3 nodelay;
    allow 10.0.0.0/8;
    deny  all;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}