https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-14T21:19:43.653022+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-351256 EUVD-2026-351256 2026-10-14T21:19:43.655298+00:00 EUVD-2026-351256 https://cve.radiocsirt.org/vuln/fkie_cve-2026-69115 fkie_cve-2026-69115 2026-10-14T21:19:43.655327+00:00

OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/get_users, /user/get_all_users_uid, and /group/get_groups. Attackers can exploit the absent authverify.CheckAdmin() call in the GetPaginationUsers, GetAllUserID, and GetGroups handlers to enumerate all platform user accounts including userIDs, nicknames, and manager level flags, as well as all groups including private groups the user has never joined, exposing group names, owner IDs, and member counts.

 https://cve.radiocsirt.org/vuln/ghsa-pp5r-q37v-qxvp GHSA-pp5r-q37v-qxvp 2026-10-14T21:19:43.655358+00:00

OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/get_users, /user/get_all_users_uid, and /group/get_groups. Attackers can exploit the absent authverify.CheckAdmin() call in the GetPaginationUsers, GetAllUserID, and GetGroups handlers to enumerate all platform user accounts including userIDs, nicknames, and manager level flags, as well as all groups including private groups the user has never joined, exposing group names, owner IDs, and member counts.