CVE-2023-30956: IDOR in Foundry Comments allows retrieval of attachments

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-10 · updated 2026-06-17
Weakness: CWE-639

Description

A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of the target attachment. This defect was resolved with the release of Foundry Comments 2.267.0.

Affected products

Palantir Foundry Comments: before 2.267.0 — fixed in 2.267.0

How to fix

Upgrade to a fixed version: Palantir Foundry Comments 2.267.0. Check the vendor advisory for mitigations.

References

https://palantir.safebase.us/?tcuUid=40367943-738c-4e69-b852-4a503c77478a
https://palantir.safebase.us/?tcuUid=40367943-738c-4e69-b852-4a503c77478a

Get alerted when CVE-2023-30956 or the next vulnerability affects your stack