CVE-2026-85210

Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with openaccess, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filtercriterion parameters to retrieve usernames holding specific roles, banned flags, an...

CVE-2026-85210

Oppia (through 3.5.2) has a missing authorization flaw in the AdminRoleHandler GET endpoint located in core/controllers/admin.py. The endpoint is decorated with open_access , which allows any registered user to query it using filter_criterion parameters and retrieve usernames holding specific rol...

EUVD-2026-70488

Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with openaccess, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filtercriterion parameters to retrieve usernames holding specific roles, banned flags, an...