CVE-2026-41878highCWE-639

CVE-2026-41878: high-severity vulnerability in R-SOFT SERWIS DMS

Insecure Direct Object Reference in R-SOFT DMS

Published

Follow this CVE+ Monitor DMS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.5%
R-SOFT DMS is vulnerable to Insecure Direct Object Reference (IDOR) attack in multiple file download endpoints. The application fetches files from the database by ID and serves them to whoever requests them, relying only on session authentication, meaning any valid user can access any file. This issue was fixed in version v3.19-2862 and v3.17-2580.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
R-SOFT SERWIS · DMS
Related CVEs — R-SOFT SERWIS DMS

In the same product, most dangerous first.

CVE-2026-41880CRITICALOS Command Injection in R-SOFT DMSEPSS 1.3%CVE-2026-41876HIGHOS Command Injection in R-SOFT DMSEPSS 1.2%CVE-2026-41877MEDIUMStored XSS in R-SOFT DMSEPSS 0.4%CVE-2026-41879HIGHWeak password hashing in R-SOFT DMSEPSS 0.3%