CVE-2026-66091

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details username, first name, last name and email address withi...

CVE-2026-66091 Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details username, first name, last name and email address withi...

CVE-2026-66091

In openEQUELLA versions prior to 2026.1 , the GET /api/userquery/userinfobackup endpoint is vulnerable to an Insecure Direct Object Reference (IDOR) because it fails to perform adequate authentication or authorization checks. An unauthenticated attacker can provide a victim's uniqueId to retrieve...

EUVD-2026-112567

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details username, first name, last name and email address withi...