Vulnerabilidades do Oppia Oppia
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Oppia Oppia: 1 registro(s), com versões afetadas e correções.
CVE-2026-85210
Média · 4.3
CWE-862 03/09/2026
Oppia through 3.5.2 Missing Authorization on AdminRoleHandler GET
Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filter_criterion parameters to retrieve usernames holding specific roles, banned flags, and managed topic identifiers without authorization.