Read the docs
TI-2026-75435 Aliases CVE-2026-111649GHSA-x97c-6hxr-5qp6

Insecure reference in Rocboss paopao-ce exposes private attachments

Priority MEDIUM 64CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference (CWE-639) in DownloadAttachment. An authenticated user can supply arbitrary content IDs to obtain signed download URLs for other users' private, friend-only and following-only images, videos and attachments.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access private media by supplying arbitrary content IDs. Attackers can enumerate sequential post_content ids via the /v1/attachment endpoint to obtain signed download URLs for other users' private, friend-only and following-only images, videos and attachments.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00386 32nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rocbosspaopao-ceup to 0.6.0-alpha.3—No fix listedCNA
  • paopao-ce Vendorrocboss Affected up to 0.6.0-alpha.3 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for paopao-ce.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111649
  2. 2026-10-16 Alias added: GHSA-x97c-6hxr-5qp6
  3. 2026-10-18 Priority changed: MEDIUM → LOW
  4. 2026-10-21 CISA SSVC decision points changed
  5. 2026-10-21 Priority changed: LOW → MEDIUM

References

Advisory 1

Other 2

  • TI-2019-08484 app/controllers/frontend/PostController.php in ROCBOSS V2.2.1 has SQL injection via the… CVSS 3.0CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences