CVE-2026-71234 describes a broken authentication vulnerability in Documize Community's attachment download route. The affected code resides in domain/attachment/endpoint.go within the Download function, which is registered via AddPublic with no authentication middleware. The vulnerability stems from a flawed token check: access is granted whenever the 'secure' query parameter is simply non-empty (len(secureToken) > 0), without validating the token against any server-stored value. This means any non-empty string such as '?secure=x' completely bypasses authentication. As a result, an unauthenticated attacker can download attachments belonging to any organization hosted on the platform. Sibling handlers in the same file (togglePublish, delete) correctly enforce session-based authorization, confirming this is a code-level inconsistency rather than intentional design. The vulnerability poses a significant risk to confidentiality of stored organizational documents and attachments.