CVE-2026-66091: medium-severity vulnerability in Apereo Foundation openEQUELLA
Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.4%
In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first name, last name and email address) within the same institution.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Apereo Foundation · openEQUELLARelated CVEs — Apereo Foundation openEQUELLA
In the same product, most dangerous first.
CVE-2026-66088CRITICALUnrestricted Command Execution via system.executeEPSS 0.7%CVE-2026-67615HIGHopenEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP InvokerEPSS 0.5%CVE-2026-66092MEDIUMStored XSS in pre-login notice via reachable legacy logon routeEPSS 0.3%CVE-2026-16889MEDIUMStored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application OriginEPSS 0.3%CVE-2026-66090HIGHXML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File ReadEPSS 0.3%CVE-2026-66089MEDIUMXML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity ExpansionEPSS 0.3%