CVE-2026-70561 in TestLink
Summary
by MITRE • 08/07/2026
TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role authorization check. Attackers can enumerate sequential integer IDs through the attachment download endpoint to retrieve file contents from private projects they have no membership in, bypassing the per-project access control model and exposing test specifications, requirements documents, execution evidence, and other sensitive uploaded files across the entire installation.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability under discussion represents a critical insecure direct object reference flaw within TestLink version 1.9.20 and earlier installations. This weakness manifests in the attachmentdownload.php handler which fails to implement proper authorization checks before serving file content. The flaw operates through a fundamental design oversight where the system accepts direct integer identifiers for attachments without verifying whether the authenticated user possesses legitimate access rights to the associated project or resource. This architectural deficiency allows any authenticated user regardless of their privilege level to exploit the system by simply crafting requests with sequential attachment ID values.
The technical exploitation mechanism relies on the predictable nature of integer-based identification systems where attackers can enumerate valid attachment IDs through iterative requests to the download endpoint. This enumeration process enables unauthorized access to sensitive data stored within private projects that the attacker has no formal membership or authorization to access. The vulnerability specifically targets the per-project access control model that should normally restrict file access based on user roles and project memberships, but this protection is completely bypassed by the insecure implementation.
From an operational impact perspective, the vulnerability exposes a significant risk to organizations using TestLink for software testing and quality assurance processes. The compromised data includes test specifications, requirements documents, execution evidence, and other sensitive materials that may contain proprietary information, security configurations, or business-critical test results. This exposure affects the entire TestLink installation rather than individual projects, meaning that a single authenticated user can potentially access all attachments across the system. The breach undermines the fundamental security assumptions of project isolation and access control that organizations rely upon for protecting sensitive testing artifacts.
The vulnerability aligns with CWE-639 which specifically addresses insecure direct object references in applications where access controls are bypassed through manipulation of object identifiers. This weakness falls under the broader category of authorization bypass vulnerabilities that represent a significant threat vector in web applications. The ATT&CK framework categorizes this as a privilege escalation technique where attackers leverage application flaws to gain unauthorized access to resources beyond their intended scope. Organizations implementing TestLink should consider this vulnerability as part of their overall security posture assessment, particularly in environments where sensitive testing data is stored and managed through the platform.
Mitigation strategies should focus on implementing proper access control validation within the attachmentdownload.php handler before serving any file content. The system must verify that authenticated users possess appropriate project membership or authorization rights before allowing access to specific attachments. This includes implementing role-based access controls that check user permissions against project memberships and enforcing proper input validation for attachment ID parameters. Organizations should also consider implementing rate limiting and logging mechanisms around the attachment download endpoint to detect and prevent enumeration attempts. Additionally, regular security audits of web application components should include thorough testing of access control mechanisms to identify similar vulnerabilities in other parts of the system architecture.