CVE-2026-54050 Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image

Sakai is a Collaboration and Learning Environment CLE. From 23.0 until 23.5 and 25.3, the DELETE /api/users/userId/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage passes the attacker-controlled userId to...

CVE-2026-54050

Sakai (a Collaboration and Learning Environment) has an IDOR in its REST API: the DELETE /api/users/{userId}/profile/image endpoint in ProfileController.removeProfileImage() passes the attacker-controlled userId to the service layer without verifying ownership, allowing any authenticated user to ...

CVE-2026-54050 Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image

Sakai is a Collaboration and Learning Environment CLE. From 23.0 until 23.5 and 25.3, the DELETE /api/users/userId/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage passes the attacker-controlled userId to...

CVE-2026-54050 Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image

Sakai is a Collaboration and Learning Environment CLE. From 23.0 until 23.5 and 25.3, the DELETE /api/users/userId/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage passes the attacker-controlled userId to...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the removeProfileImage process. An attacker can remove another user's profile image without authorization by sending a crafted DELETE request with the target user's identifier...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the removeProfileImage process. An attacker can remove another user's profile image without authorization by sending a crafted DELETE request with the target user's identifier...

Sakai Profile Image Deletion has an IDOR

Summary The Sakai REST API endpoint DELETE /api/users/userId/profile/image does not verify that the requesting user is authorized to modify the target user's profile. Any authenticated user can delete the profile image of any other user, including administrators, by supplying a different userId i...

GHSA-9284-FJC3-FMMJ Sakai Profile Image Deletion has an IDOR

Summary The Sakai REST API endpoint DELETE /api/users/userId/profile/image does not verify that the requesting user is authorized to modify the target user's profile. Any authenticated user can delete the profile image of any other user, including administrators, by supplying a different userId i...

PT-2026-81117

Summary The Sakai REST API endpoint DELETE /api/users/userId/profile/image does not verify that the requesting user is authorized to modify the target user's profile. Any authenticated user can delete the profile image of any other user, including administrators, by supplying a different userId i...

CVE-2026-18927

A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. This affects the function storeProfileImage of the file studentprofilepic.php of the component Shared Upload Helper. Executing a manipulati...

EUVD-2026-53470

A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. This affects the function storeProfileImage of the file studentprofilepic.php of the component Shared Upload Helper. Executing a manipulati...

CVE-2026-18927 imranrisal-dev Student-Management-System Shared Upload Helper student_profile_pic.php storeProfileImage unrestricted upload

A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. This affects the function storeProfileImage of the file studentprofilepic.php of the component Shared Upload Helper. Executing a manipulati...

CVE-2026-18927

CVE-2026-18927 affects imranrisal-dev Student-Management-System, specifically the Shared Upload Helper’s file student_profile_pic.php function storeProfileImage. An attacker can manipulate the argument choose_file to achieve unrestricted file upload, with the attack executable remotely. The explo...

CVE-2026-57205

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/info/ and GET /api/user/profile-image/ endpoints in application/singleapp/routebackendusers.py accepted a caller-supplied...

CVE-2026-57205

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/info/ and GET /api/user/profile-image/ endpoints in application/singleapp/routebackendusers.py accepted a caller-supplied...

CVE-2026-57205 SimpleChat: Authenticated users can access other users' profile metadata through user IDOR endpoints

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/info/ and GET /api/user/profile-image/ endpoints in application/singleapp/routebackendusers.py accepted a caller-supplied...

CVE-2026-57205

CVE-2026-57205 affects SimpleChat prior to version 0.241.203. An authenticated low-privilege user could exploit IDOR on two endpoints (GET /api/user/info/ and GET /api/user/profile-image/) by supplying a caller-controlled user_id to read another user’s email address, display name, and profile ima...

CVE-2026-57205 SimpleChat: Authenticated users can access other users' profile metadata through user IDOR endpoints

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/info/ and GET /api/user/profile-image/ endpoints in application/singleapp/routebackendusers.py accepted a caller-supplied...

PT-2026-60487

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/info/ and GET /api/user/profile-image/ endpoints in application/single app/route backend users.py accepted a caller-supplie...

CVE-2026-56398 Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs...