EUVD-2026-109276

ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of...

CVE-2026-116018

The ONEARMY community-platform (versions before 2.165.2 ) contains an insecure direct object reference (IDOR) vulnerability in the notification read endpoint. Authenticated users can exploit this via POST /api/notifications/:id/read to mark other users' notifications as read. By iterating through...