CVE-2026-39616

CVE-2026-39616 is an authorization bypass vulnerability in dFactory's Download Attachments plugin versions 1.4.0 and earlier, stemming from incorrectly configured access control that allows exploitation through user-controlled keys. The vulnerability enables attackers to circumvent security levels and gain unauthorized access to protected attachments. The vulnerability presents medium severity with a CVSS score of 5.3, featuring a network-based attack vector requiring no authentication or user interaction, making it relatively straightforward to exploit. The primary impact is integrity compromise, allowing unauthorized modification or access to attachment data, though confidentiality and availability are not directly affected. There is currently no evidence of active exploitation in the wild, no public exploit code availability, and minimal community attention, as indicated by the vulnerability's inactive status on threat tracking lists and an extremely low EPSS score of 0.00037. Organizations using affected versions should prioritize patching to versions newer than 1.4.0 as part of standard maintenance, though the low exploitation risk does not warrant emergency response measures.