CVE-2026-69115

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-69115", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-03T13:26:21.234Z", "datePublished": "2026-08-11T18:21:52.912Z", "dateUpdated": "2026-11-08T14:08:22.344Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:08:22.344Z"}, "datePublic": "2026-08-11T00:00:00.000Z", "title": "OpenIM Server v3.8.3 Missing Authorization on User and Group Enumeration Endpoints", "descriptions": [{"lang": "en", "value": "OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/get_users, /user/get_all_users_uid, and /group/get_groups. Attackers can exploit the absent authverify.CheckAdmin() call in the GetPaginationUsers, GetAllUserID, and GetGroups handlers to enumerate all platform user accounts including userIDs, nicknames, and manager level flags, as well as all groups including private groups the user has never joined, exposing group names, owner IDs, and member counts."}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "Missing Authorization", "type": "CWE"}]}], "affected": [{"defaultStatus": "affected", "vendor": "OpenIMSDK", "product": "OpenIM Server (open-im-server)", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.8.3"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "references": [{"url": "https://github.com/openimsdk/open-im-server", "name": "Product Repository", "tags": ["product"]}, {"url": "https://github.com/openimsdk/open-im-server/issues/3778", "name": "GitHub Issue", "tags": ["issue-tracking"]}, {"url": "https://github.com/openimsdk/open-im-server/commit/193870b2f938278b27a2d8347bd7e4db5f8f9dfc", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/openimsdk/open-im-server/pull/3781", "name": "Pull Request", "tags": ["issue-tracking", "patch"]}, {"url": "https://www.vulncheck.com/advisories/openim-server-missing-authorization-on-user-and-group-enumeration-endpoints", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "George Chen", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "vulncheck"}}, "adp": [{"references": [{"url": "https://github.com/openimsdk/open-im-server/issues/3778", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T20:02:40.293085Z", "id": "CVE-2026-69115", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T20:03:05.306Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-69115", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T20:02:40.293085Z"}}}], "references": [{"url": "https://github.com/openimsdk/open-im-server/issues/3778", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T20:02:59.955Z"}}], "cna": {"title": "OpenIM Server v3.8.3 Missing Authorization on User and Group Enumeration Endpoints", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "George Chen"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OpenIMSDK", "product": "OpenIM Server (open-im-server)", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.8.3"}], "defaultStatus": "affected"}], "datePublic": "2026-08-11T00:00:00.000Z", "references": [{"url": "https://github.com/openimsdk/open-im-server", "name": "Product Repository", "tags": ["product"]}, {"url": "https://github.com/openimsdk/open-im-server/issues/3778", "name": "GitHub Issue", "tags": ["issue-tracking"]}, {"url": "https://github.com/openimsdk/open-im-server/commit/193870b2f938278b27a2d8347bd7e4db5f8f9dfc", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/openimsdk/open-im-server/pull/3781", "name": "Pull Request", "tags": ["issue-tracking", "patch"]}, {"url": "https://www.vulncheck.com/advisories/openim-server-missing-authorization-on-user-and-group-enumeration-endpoints", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/get_users, /user/get_all_users_uid, and /group/get_groups. Attackers can exploit the absent authverify.CheckAdmin() call in the GetPaginationUsers, GetAllUserID, and GetGroups handlers to enumerate all platform user accounts including userIDs, nicknames, and manager level flags, as well as all groups including private groups the user has never joined, exposing group names, owner IDs, and member counts."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:08:22.344Z"}}}, "cveMetadata": {"cveId": "CVE-2026-69115", "state": "PUBLISHED", "dateUpdated": "2026-11-08T14:08:22.344Z", "dateReserved": "2026-08-03T13:26:21.234Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-11T18:21:52.912Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "OpenIM Server (open-im-server)", "vendor": "OpenIMSDK", "versions": [{"lessThanOrEqual": "3.8.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/get_users, /user/get_all_users_uid, and /group/get_groups. Attackers can exploit the absent authverify.CheckAdmin() call in the GetPaginationUsers, GetAllUserID, and GetGroups handlers to enumerate all platform user accounts including userIDs, nicknames, and manager level flags, as well as all groups including private groups the user has never joined, exposing group names, owner IDs, and member counts."}, {"lang": "es", "value": "OpenIM Server v3.8.3 contiene una vulnerabilidad de autorizaci\u00f3n faltante que permite a cualquier usuario autenticado acceder a los endpoints de la API de gesti\u00f3n solo para administradores enviando solicitudes POST con un token de portador de usuario regular a /user/get_users, /user/get_all_users_uid y /group/get_groups. Los atacantes pueden explotar la llamada ausente a authverify.CheckAdmin() en los manejadores GetPaginationUsers, GetAllUserID y GetGroups para enumerar todas las cuentas de usuario de la plataforma, incluyendo userIDs, apodos y banderas de nivel de gerente, as\u00ed como todos los grupos, incluyendo los grupos privados a los que el usuario nunca se ha unido, exponiendo nombres de grupo, IDs de propietario y recuentos de miembros."}], "id": "CVE-2026-69115", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-69115", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T20:02:40.293085Z", "version": "2.0.3"}}]}, "published": "2026-08-11T19:18:42.093", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/openimsdk/open-im-server"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/openimsdk/open-im-server/commit/193870b2f938278b27a2d8347bd7e4db5f8f9dfc"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/openimsdk/open-im-server/issues/3778"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/openimsdk/open-im-server/pull/3781"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/openim-server-missing-authorization-on-user-and-group-enumeration-endpoints"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/openimsdk/open-im-server/issues/3778"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.8.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "OpenIM Server (open-im-server)", "source": "cna", "vendor": "OpenIMSDK"}, "product": "openim_server_(open-im-server)", "vendor": "openimsdk"}], "created": "2026-08-12T20:45:08.813268+00:00", "updated": "2026-08-13T09:49:43.811607+00:00", "vendors": ["openimsdk", "openimsdk$PRODUCT$openim_server_(open-im-server)"]}