CVE-2026-70561 TestLinkOpenSourceTRMS CVE debrief

Who should care

Defenders responsible for TestLink installations, particularly those with exposed or internet-facing instances, should assess their exposure and prioritize remediation. This includes reviewing compensating controls, monitoring for suspicious activity, and ensuring proper authorization checks are in place.

Why it matters

CVE-2026-70561 allows authenticated users to read arbitrary attachments in TestLink 1.9.20 and prior, bypassing access controls and potentially exposing sensitive information.

• Authenticated users can access sensitive files across projects
• Bypassing per-project access control model
• Exposure of test specifications, requirements documents, and execution evidence
• Potential data leakage through sequential ID enumeration

Technical summary

The TestLink application, version 1.9.20 and prior, contains an insecure direct object reference vulnerability. This vulnerability allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role authorization check. The vulnerability enables attackers to bypass the per-project access control model, potentially exposing sensitive information such as test specifications, requirements documents, and execution evidence across the entire installation.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in TestLink installations, focusing on restricting access to attachment downloads.

Recommended defensive actions

• Verify TestLink version and restrict access to attachment downloads
• Implement proper authorization checks for attachment access
• Monitor for suspicious attachment download activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the insecure direct object reference vulnerability in TestLink 1.9.20 and prior. The vulnerability allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role authorization check. The source details indicate that attackers can enumerate sequential integer IDs to retrieve file contents from private projects they have no membership in.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.