Insecure direct object reference in ONEARMY community-platform notifications
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
ONEARMY community-platform before 2.165.2 contains an insecure direct object reference that lets authenticated users mark other users' notifications as read through the notification read endpoint. Because notification IDs are sequential, an attacker can iterate over them to suppress the unread indicators of users in the same tenant, so those users miss replies, comments and new-content notices. The flaw is classified as CWE-639, an authorization bypass through a user-controlled key. Exploitation requires a low-privileged authenticated account and requires no user interaction, and the impact is limited to integrity.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of users in the same tenant, causing them to miss replies, comments and new-content notices.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
ONEARMY community-platform should be updated to version 2.165.2, which fixes the flaw. The sources do not list a vendor advisory identifier for this fix.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA community-platform (ONEARMY) Fixed in 2.165.2
Timeline
- 2026-10-24 Threatist record created from CVE-2026-116018
- 2026-10-24 Alias added: GHSA-rq5g-4m5j-8p36
- 2026-10-29 CISA SSVC decision points changed
- 2026-10-29 Priority changed: LOW → MEDIUM
References
Patch 2
Sources
- CVE-2026-116018 · CVE Program
- CVE-2026-116018 · NVD
- FIRST EPSS
- GHSA-rq5g-4m5j-8p36 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences