CVE-2026-69115

{
  "id": "CVE-2026-69115",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-11T19:18:42.093",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/get_users, /user/get_all_users_uid, and /group/get_groups. Attackers can exploit the absent authverify.CheckAdmin() call in the GetPaginationUsers, GetAllUserID, and GetGroups handlers to enumerate all platform user accounts including userIDs, nicknames, and manager level flags, as well as all groups including private groups the user has never joined, exposing group names, owner IDs, and member counts."
    },
    {
      "lang": "es",
      "value": "OpenIM Server v3.8.3 contiene una vulnerabilidad de autorización faltante que permite a cualquier usuario autenticado acceder a los endpoints de la API de gestión solo para administradores enviando solicitudes POST con un token de portador de usuario regular a /user/get_users, /user/get_all_users_uid y /group/get_groups. Los atacantes pueden explotar la llamada ausente a authverify.CheckAdmin() en los manejadores GetPaginationUsers, GetAllUserID y GetGroups para enumerar todas las cuentas de usuario de la plataforma, incluyendo userIDs, apodos y banderas de nivel de gerente, así como todos los grupos, incluyendo los grupos privados a los que el usuario nunca se ha unido, exponiendo nombres de grupo, IDs de propietario y recuentos de miembros."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "OpenIMSDK",
          "product": "OpenIM Server (open-im-server)",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "3.8.3",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-11T20:02:40.293085Z",
          "id": "CVE-2026-69115",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/openimsdk/open-im-server",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/openimsdk/open-im-server/commit/193870b2f938278b27a2d8347bd7e4db5f8f9dfc",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/openimsdk/open-im-server/issues/3778",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/openimsdk/open-im-server/pull/3781",
      "source": "[email protected]"
    },
    {
      "url": "https://www.vulncheck.com/advisories/openim-server-missing-authorization-on-user-and-group-enumeration-endpoints",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/openimsdk/open-im-server/issues/3778",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}