CVE Intelligence

Oppia vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Oppia products: 1 record(s), with severity, exploitation and fixes.

Oppia 1

Exploited only (KEV) →

CVE-2026-85210 Medium · 4.3 CWE-862 Sep 3, 2026
Oppia through 3.5.2 Missing Authorization on AdminRoleHandler GET
Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filter_criterion parameters to retrieve usernames holding specific roles, banned flags, and managed topic identifiers without authorization.