CVE-2026-41878: DMS 0 to before v3.19-2862, 0 to before v3.17-2580

CVE-2026-41878. EPSS 0.0047 (percentile 0.39715), scored 24-Oct-2026.

Affected technology

DMS · 0 to before v3.19-2862, 0 to before v3.17-2580
R-SOFT SERWIS

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source says the application fetches files from the database by ID and serves them to whoever requests them, relying only on session authentication, meaning any valid user can access any file. Vendor/CNA’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality impact as high; integrity and availability impact as none.

Published 25-Oct-2026 19:52 UTC

CWE: CWE-639
CCR priority: 0.1 /100 (P5)
EPSS: 0.0047 · percentile 0.40344 · 2026-10-25
KEV: no

Provenance

FIRST EPSS daily exploit-probability · Source record · observed 2026-10-25 19:52:47.952465+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-25 19:51:06.643138+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-41878.html