IDOR in LingGuo-Drama lets users access other users' projects
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
LingGuo-Drama through commit 8a6924a contains an insecure direct object reference that lets registered users access other users' projects. The projects.Get function does not check the project owner, so access control depends on user-controlled IDs (CWE-639). A self-registered attacker can iterate numeric project IDs over the admin projects endpoint to read, overwrite, reassign or delete any user's short-drama projects.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
No affected products listed by the sources yet.
Remediation
The sources list no fixed version for LingGuo-Drama.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111722
- 2026-10-16 CISA SSVC decision points changed
- 2026-10-16 Priority changed: MEDIUM → HIGH
- 2026-10-18 Alias added: GHSA-4cg4-g3g8-qxpg
References
Other 3
- https://github.com/LingGuoAI/LingGuo-Drama/blob/8a6924adf8142678919b4d9a08b9d60c49dcfbed/server/app/models/projects/projects_utils.go#L11-L14
- https://github.com/LingGuoAI/LingGuo-Drama/blob/8a6924adf8142678919b4d9a08b9d60c49dcfbed/server/app/http/controllers/admin/v1/projects_controller.go#L173-L198
- https://github.com/LingGuoAI/LingGuo-Drama/blob/8a6924adf8142678919b4d9a08b9d60c49dcfbed/server/routes/admin.go#L26-L31
More LingGuoAI vulnerabilities
- TI-2026-75509 Missing authorization in LingGuo-Drama lets any user manage accounts CVSS 4.0HIGH 8.7
Sources
- CVE-2026-111722 · CVE Program
- CVE-2026-111722 · NVD
- FIRST EPSS
- GHSA-4cg4-g3g8-qxpg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences