Vulnerability in org.sakaiproject.profile2:profile2-api (CVE-2026-54050)
Summary
Vulnerability in org.sakaiproject.profile2:profile2-api (CVE-2026-54050). Data can be tampered with by attackers. Exploitable via DELETE /api/users/{userId}/profile/image.
Original description
The description as published by the source.
Summary
The Sakai REST API endpoint DELETE /api/users/{userId}/profile/image does not verify that the requesting user is authorized to modify the target user's profile. Any authenticated user can delete the profile image of any other user, including administrators, by supplying a different userId in the path. The service layer has no authorization check, and the delete cascades through Content Hosting Service (CHS) with a security advisor that bypasses all CHS permission checks.
Details
ProfileController.removeProfileImage() in the webapi module retrieves the current user's session but performs no comparison between the authenticated user and the target userId path parameter:
@DeleteMapping(value = "/users/{userId}/profile/image")
public ResponseEntity removeProfileImage(@PathVariable String userId) {
String currentUserId = checkSakaiSession().getUserId();
if (currentUserId == null) {
return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
}
profileService.removeProfileImage(userId); // userId is attacker-controlled
return ResponseEntity.ok().build();
}
ProfileServiceImpl.removeProfileImage() delegates directly to dao.removeProfileImage(userUuid) with no authorization check. The DAO calls profileImageUploadedRepository.deleteById(userId), removing the profile_images_t row unconditionally.
For contrast, the upload endpoint setProfileImage() correctly verifies ownership:
if (!sakaiProxy.isSuper…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-54050 has been found in org.sakaiproject.profile2:profile2-api.
Attackers can target a specific entry point like DELETE /api/users/{userId}/profile/image over the network to misuse the product.
Data can be tampered with by attackers. CVSS score: 6.5/10.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "org.sakaiproject.profile2:profile2-api CVE-2026-54050" on the vendor's site.
CVE-2026-54050 (org.sakaiproject.profile2:profile2-api) — CWE-639 / CVSS v3 6.5
Attack vector: remote (network-reachable) / no user interaction
Attack surface: DELETE /api/users/{userId}/profile/image / DELETE /api/users/{userId}/profile/pronunciation / POST /api/users/admin/profile/image / DELETE /api/users/admin/profile/image
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-639) exists in org.sakaiproject.profile2:profile2-api. Attackers reach the vulnerable code path via DELETE /api/users/{userId}/profile/image.
Check the vendor advisory for the affected versions of org.sakaiproject.profile2:profile2-api. Attack surface: DELETE /api/users/{userId}/profile/image / DELETE /api/users/{userId}/profile/pronunciation / POST /api/users/admin/profile/image / DELETE /api/users/admin/profile/image.
Severity: Medium (CVSS 6.5/10). Data can be tampered with by attackers.
Update to the patched release per vendor advisory.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual DELETE /api/users/{userId}/profile/image requests with malformed payloads or SQL meta-characters. Audit SBOM/dependencies to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
Audit SBOM/dependencies for affected components.資産台帳・SBOM・依存マニフェストで org.sakaiproject.profile2:profile2-api を使っているサービスとバージョンを洗い出す。
-
2Hunt for indicators of compromise detect
grep 'DELETE /api/users/{userId}/profile/image' /var/log/nginx/access.log | grep -E '(unusual_payload|sqli_pattern)'アクセスログで
DELETE /api/users/{userId}/profile/imageへの異常なリクエスト (不正な認証ヘッダ・SQLメタ文字)を過去 30〜90日分捜索。WAF/SIEM があれば該当パスのアラート発火履歴を確認。 -
3Post-deployment verification verify
Replay attack against DELETE /api/users/{userId}/profile/image on staging to confirm patch closes the vectorパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 2 と同じログクエリでアラート再発が無いか継続監視。
Affected packages
References
- package github.com
- web github.com
- web github.com
- web github.com
- web github.com