CVE-2026-123617: falha de média gravidade em openwhyd
Openwhyd before 1.65.1 NoSQL Injection via POST /api/user
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
10Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9
Openwhyd before 1.65.1 contains a NoSQL injection vulnerability that allows unauthenticated attackers to manipulate user lookups by passing JSON objects in the id parameter. Attackers can send MongoDB query operators such as $ne or $gt to POST /api/user to select and enumerate other users' public profile records.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
openwhyd · openwhydReferências
https://github.com/openwhyd/openwhyd/blob/v1.65.0/app/models/user.js#L288-L294https://github.com/openwhyd/openwhyd/commit/167c45d6754df0adb3415f71cbd7cde91cbe7874https://github.com/openwhyd/openwhyd/releases/tag/v1.65.1https://github.com/openwhyd/openwhyd/security/advisories/GHSA-hfg3-vq24-hprphttps://www.vulncheck.com/advisories/openwhyd-before-1.65.1-nosql-injection-via-post-api-user