CVE-2024-27292: Docassemble URL manipulation exposes unauthorized information

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote information disclosure with a high CVSS score and very high EPSS probability, though no confirmed in-the-wild exploitation is documented.

What it is

Docassemble versions 1.4.53 through 1.4.96 allow attackers to gain unauthorized access to information on the system through URL manipulation, a path/access-control weakness (CWE-706). The flaw is remotely reachable without authentication and was patched in version 1.4.97 on the master branch, so unpatched deployments risk exposure of data the application is meant to protect.

Impact

An attacker can read information on the system that they are not authorized to access. The CVSS vector rates confidentiality impact as high with no integrity or availability effect.

Attack surface

Reachable over the network via crafted URLs (AV:N, AC:L, PR:N, UI:N), so no authentication or user interaction is required. Any internet- or network-exposed Docassemble instance in the affected version range is a candidate.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is very high (0.69486, 99.3rd percentile), indicating elevated likelihood of attempted exploitation; references are limited to the patch commit and a GitHub security advisory.

What to do

• Upgrade Docassemble to version 1.4.97 or later from the master branch; this is the vendor-provided fix.
• If immediate upgrade is not possible, restrict network access to the Docassemble service to trusted users and networks.
• Review web server and application logs for anomalous URL patterns targeting the affected version range.
• Confirm the deployed version against the 1.4.53 to 1.4.96 affected range and track any backported fixes.
• Treat any data reachable through the application as potentially exposed and assess whether notification or credential rotation is warranted.

Detection

• Search web access logs for unusual or manipulated URL paths and encoded traversal-style sequences against Docassemble endpoints.
• Alert on requests to Docassemble from unexpected source IPs or user agents, especially unauthenticated access to data-bearing URLs.
• Inventory Docassemble instances and flag any reporting version 1.4.53 through 1.4.96.
• Correlate large or repeated data retrievals from a single source with no corresponding authenticated session.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.