CVE-2026-32097

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32097", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-10T22:02:38.853Z", "datePublished": "2026-03-11T19:55:51.707Z", "dateUpdated": "2026-03-12T19:50:51.551Z"}, "containers": {"cna": {"title": "PingPong has improper access control in thread file endpoints allows access outside intended scope", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/comppolicylab/pingpong/security/advisories/GHSA-4wwr-5wq7-mgm4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/comppolicylab/pingpong/security/advisories/GHSA-4wwr-5wq7-mgm4"}], "affected": [{"vendor": "comppolicylab", "product": "pingpong", "versions": [{"version": "< 7.27.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T19:55:51.707Z"}, "descriptions": [{"lang": "en", "value": "PingPong is a platform for using large language models (LLMs) for teaching and learning. Prior to 7.27.2, an authenticated user may be able to retrieve or delete files outside the intended authorization scope. This issue could result in retrieval or deletion of private files, including user-uploaded files and model-generated output files. Exploitation required authentication and permission to view at least one thread for retrieval, and authentication and permission to participate in at least one thread for deletion. This vulnerability is fixed in 7.27.2."}], "source": {"advisory": "GHSA-4wwr-5wq7-mgm4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T19:50:44.804480Z", "id": "CVE-2026-32097", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T19:50:51.551Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32097", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-12T19:50:44.804480Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T19:50:48.681Z"}}], "cna": {"title": "PingPong has improper access control in thread file endpoints allows access outside intended scope", "source": {"advisory": "GHSA-4wwr-5wq7-mgm4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "comppolicylab", "product": "pingpong", "versions": [{"status": "affected", "version": "< 7.27.2"}]}], "references": [{"url": "https://github.com/comppolicylab/pingpong/security/advisories/GHSA-4wwr-5wq7-mgm4", "name": "https://github.com/comppolicylab/pingpong/security/advisories/GHSA-4wwr-5wq7-mgm4", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "PingPong is a platform for using large language models (LLMs) for teaching and learning. Prior to 7.27.2, an authenticated user may be able to retrieve or delete files outside the intended authorization scope. This issue could result in retrieval or deletion of private files, including user-uploaded files and model-generated output files. Exploitation required authentication and permission to view at least one thread for retrieval, and authentication and permission to participate in at least one thread for deletion. This vulnerability is fixed in 7.27.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T19:55:51.707Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32097", "state": "PUBLISHED", "dateUpdated": "2026-03-12T19:50:51.551Z", "dateReserved": "2026-03-10T22:02:38.853Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-11T19:55:51.707Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "pingpong", "vendor": "comppolicylab", "versions": [{"status": "affected", "version": "< 7.27.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:harvard:pingpong:*:*:*:*:*:*:*:*", "matchCriteriaId": "39B20274-5A18-4D35-A7DF-94E23C9C8B80", "versionEndExcluding": "7.27.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PingPong is a platform for using large language models (LLMs) for teaching and learning. Prior to 7.27.2, an authenticated user may be able to retrieve or delete files outside the intended authorization scope. This issue could result in retrieval or deletion of private files, including user-uploaded files and model-generated output files. Exploitation required authentication and permission to view at least one thread for retrieval, and authentication and permission to participate in at least one thread for deletion. This vulnerability is fixed in 7.27.2."}, {"lang": "es", "value": "PingPong es una plataforma para usar modelos de lenguaje grandes (LLM) para la ense\u00f1anza y el aprendizaje. Antes de la versi\u00f3n 7.27.2, un usuario autenticado podr\u00eda recuperar o eliminar archivos fuera del alcance de autorizaci\u00f3n previsto. Este problema podr\u00eda resultar en la recuperaci\u00f3n o eliminaci\u00f3n de archivos privados, incluyendo archivos subidos por el usuario y archivos de salida generados por el modelo. La explotaci\u00f3n requer\u00eda autenticaci\u00f3n y permiso para ver al menos un hilo para la recuperaci\u00f3n, y autenticaci\u00f3n y permiso para participar en al menos un hilo para la eliminaci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 7.27.2."}], "id": "CVE-2026-32097", "lastModified": "2026-06-17T10:35:07.773", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32097", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T19:50:44.804480Z", "version": "2.0.3"}}]}, "published": "2026-03-11T20:16:18.243", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/comppolicylab/pingpong/security/advisories/GHSA-4wwr-5wq7-mgm4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.27.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "pingpong", "source": "cna", "vendor": "comppolicylab"}, "product": "pingpong", "vendor": "comppolicylab"}], "analysis": {"en": {"generated_at": "2026-03-17T16:27:24.172628+00:00", "value": {"mitigation_remediation": ["Upgrade to PingPong version 7.27.2 or later (Key detail from CVE description).", "Verify that all installations have been upgraded and no instances are running a vulnerable version (Key detail from CVE description)."], "summary": {"action": "Apply Patch", "impact": "Unauthorized File Access and Deletion"}, "threat_synthesis": {"affected_systems": "Affected systems are installations of comppolicylab PingPong (CPE: cpe:2.3:a:harvard:pingpong) with versions prior to 7.27.2 (Key detail from CVE description).", "description_and_impact": "PingPong is a platform for teaching and learning with large language models (Key detail from CVE description). A flaw in its thread file endpoints allows an authenticated user to retrieve or delete files outside the intended authorization scope (Key detail from CVE description). This vulnerability could lead to retrieval or deletion of private files, including user\u2011uploaded files and model\u2011generated output files (Key detail from CVE description). The primary impact is unauthorized access and deletion of private data (Key detail from CVE description).", "risk_and_exploitability": "The CVSS score of 8.6 indicates a high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation (Key detail from SCORES). The vulnerability requires authentication and permission to view or participate in at least one thread, categorizing it as an authenticated web application vulnerability (Key detail from CVE description). Based on the description, it is inferred that the attack vector is a web application endpoint accessed by an authenticated user. This risk is not recorded in the CISA KEV catalog (Key detail from SCORES)."}}}}, "created": "2026-03-12T09:56:21.720910+00:00", "updated": "2026-03-20T15:37:27.072355+00:00", "vendors": ["comppolicylab", "comppolicylab$PRODUCT$pingpong"]}