Oppia through 3.5.2 Exposes Admin Role Data to Any Logged-In User

Published 14 minutes ago

Oppia versions through 3.5.2 decorate the AdminRoleHandler GET endpoint in core/controllers/admin.py with open_access, allowing any registered user to query it without authorization. Using filter_criterion parameters, attackers can enumerate usernames holding specific roles, banned flags, and managed topic identifiers.

Read the original coverage at CVE.org
Captured 24 minutes ago