CERT24GHSA-gj26-grcq-vm8j: Missing authentication and authorization on an openEQUELLA user-information endpointLoading data…
CERT24Threat Observatory
Period

GHSA-gj26-grcq-vm8j: Missing authentication and authorization on an openEQUELLA user-information endpoint

Before openEQUELLA 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorization check. An unauthenticated attacker who supplies another user’s uniqueId can retrieve that user’s stored personal details within the same institution.

← Back to intelligence

GHSA-gj26-grcq-vm8j: Missing authentication and authorization on an openEQUELLA user-information endpoint

Before openEQUELLA 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorization check. An unauthenticated attacker who supplies another user’s uniqueId can retrieve that user’s stored personal details within the same institution.