Medium
6.9
In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no...
CVE-2026-66091
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Apereo Foundation | openEQUELLA |
≥ 2019.2, < 2026.1 |
2026.1 |
Original description The description as published by the source.
In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first name, last name and email address) within the same institution.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web github.com
- web openequella.github.io
- web nvd.nist.gov
- web openequella.github.io
- web github.com