TI-2026-70532 Aliases CVE-2026-108164 GHSA-6qx6-fpjx-pg68

Authorization bypass in OSSN exposes private message attachments

MEDIUM 64CWE-639Published 2026-10-10 · Updated 2026-10-13

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference (CWE-639) in its message attachment component. The component does not verify that the requester is the sender or recipient of a private conversation, so an authenticated user with low privileges can read other users' private message attachments by guessing file GUIDs. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_com.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/{guid} route with sequential or guessed file GUIDs to retrieve attachments from private conversations without sender or recipient verification.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00257 17th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
opensource-socialnetwork	opensource-socialnetwork	up to 10.1	—	No fix listed	CNA

opensource-socialnetwork Vendoropensource-socialnetwork Affected up to 10.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Open Source Social Network (OSSN).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-11 Threatist record created from CVE-2026-108164
2026-10-11 Alias added: GHSA-6qx6-fpjx-pg68
2026-10-11 Priority changed: MEDIUM → LOW
2026-10-13 CISA SSVC decision points changed
2026-10-13 Priority changed: LOW → MEDIUM

References

Exploit 1

https://hackmd.io/@leediay/ossn-idor-message-attachment

Patch 1

https://github.com/opensource-socialnetwork/opensource-socialnetwork/commit/2e9733d8eaafccdaef3d9b498348c8332e51f48b

Other 3

TI-2026-29910 Open Source Social Network (OSSN) Vulnerable to Resource Exhaustion via Malicious Image Processing CVSS 3.1HIGH 8.2
TI-2026-70945 Missing authorization in OSSN exposes album photos and stored files CVSS 4.0MEDIUM 6.9
TI-2025-39373 OSSN (Open Source Social Network) 8.6 is vulnerable to SQL Injection in… CVSS 3.1MEDIUM 6.5
TI-2020-08475 An issue was discovered in Open Source Social Network (OSSN) through 5.3. CVSS 3.1MEDIUM 5.9
TI-2025-39316 Open Source Social Network (OSSN) 8.6 is vulnerable to Cross Site Scripting (XSS) via the… CVSS 3.1HIGH 7.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences