CVE-2026-66091
Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 29, 2026
- Updated
- Oct 29, 2026
- Reserved
- Jul 24, 2026
Description
In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first name, last name and email address) within the same institution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | MON-CSIRT |
Weaknesses
- CWE-639 Authorization bypass through User-Controlled key
Affected Products
| Product | Versions |
|---|---|
openEQUELLAApereo Foundation |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.