Vulnerabilidades de Oppia
CVEs publicadas que afetam produtos de Oppia: 1 registro(s), com severidade, exploração e correções.
CVE-2026-85210
Média · 4.3
CWE-862 03/09/2026
Oppia through 3.5.2 Missing Authorization on AdminRoleHandler GET
Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filter_criterion parameters to retrieve usernames holding specific roles, banned flags, and managed topic identifiers without authorization.