CVE-2026-69115
OpenIM Server v3.8.3 Missing Authorization on User and Group Enumeration Endpoints
- State
- Published
- Severity
- 7.1 High
- Published
- Aug 11, 2026
- Updated
- Aug 11, 2026
- Reserved
- Aug 3, 2026
Description
OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/get_users, /user/get_all_users_uid, and /group/get_groups. Attackers can exploit the absent authverify.CheckAdmin() call in the GetPaginationUsers, GetAllUserID, and GetGroups handlers to enumerate all platform user accounts including userIDs, nicknames, and manager level flags, as well as all groups including private groups the user has never joined, exposing group names, owner IDs, and member counts.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
OpenIM Server (open-im-server)OpenIMSDK |
|
References
- Product Repositoryproduct
- GitHub Issueissue-tracking
- Patch Commitpatch
- Pull Requestissue-tracking
- https://www.vulncheck.com/advisories/openim-server-missing-authorization-on-user-and-group-enumeration-endpointsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.