CVE-2026-66091

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first name, last name and email address) within the same institution.

CVSS

No CVSS.

References

Link	Resource
https://github.com/openequella/openEQUELLA/security/advisories/GHSA-mxj9-pmpw-j4xw
https://openequella.github.io/guides/

Configurations

No configuration.

History

29 Oct 2026, 02:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-29 02:16

Updated : 2026-10-29 15:56

NVD link : CVE-2026-66091

Mitre link : CVE-2026-66091

CVE.ORG link : CVE-2026-66091

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-66091", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66091", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T01:50:21.266595Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f", "affectedData": [{"vendor": "Apereo Foundation", "product": "openEQUELLA", "versions": [{"status": "affected", "version": "2019.2", "lessThan": "2026.1", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-29T02:16:52.933", "references": [{"url": "https://github.com/openequella/openEQUELLA/security/advisories/GHSA-mxj9-pmpw-j4xw", "source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f"}, {"url": "https://openequella.github.io/guides/", "source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first name, last name and email address) within the same institution."}], "lastModified": "2026-10-29T15:56:34.127", "sourceIdentifier": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f"}

CVE-2026-66091

JSON object

Attach tags to CVE-2026-66091

Attach tags to `CVE-2026-66091`