Beveiligingsadvies

CVE-2026-85210

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-09-03 14:12:21

Laatst bijgewerkt 2026-09-05 01:23:34

Toegewezen door VulnCheck

CVSS-score 5.3

Status PUBLISHED

Beschrijving

Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filter_criterion parameters to retrieve usernames holding specific roles, banned flags, and managed topic identifiers without authorization.

← Alle CVE's bekijken Bekijk op cve.org ↗