CVE-2026-116018

Published: Oct 24, 2026Modified: Oct 26, 2026Deferred

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of users in the same tenant, causing them to miss replies, comments and new-content notices.

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (7)

https://github.com/ONEARMY/community-platform/blob/v2.163.2/src/routes/api.notifications.$id.read.ts#L6-L22

Source: disclosure@vulncheck.com

https://github.com/ONEARMY/community-platform/commit/571732c26caf1a0a46e5335d275cef2e19dfab08

Source: disclosure@vulncheck.com

https://github.com/ONEARMY/community-platform/issues/5022

Source: disclosure@vulncheck.com

https://github.com/ONEARMY/community-platform/pull/5011

Source: disclosure@vulncheck.com

https://github.com/ONEARMY/community-platform/releases/tag/v2.165.2

Source: disclosure@vulncheck.com

https://hackmd.io/@hieuPenguinnn/onearmy-community-platform-notification-read-idor

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/onearmy-community-platform-before-2.165.2-idor-via-notification-read-endpoint

Source: disclosure@vulncheck.com

Timeline

No history available yet.