Read the docs
TI-2026-85955 Aliases CVE-2026-123617GHSA-224m-3wgx-rg59

NoSQL injection in Openwhyd user lookup exposes user profiles

Priority HIGH 70CWE-943Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Openwhyd before 1.65.1 contains a NoSQL injection flaw, tracked as CWE-943, in which user input is not neutralized before it reaches a database query. An unauthenticated remote attacker can pass JSON objects in the id parameter of POST /api/user to inject MongoDB query operators such as $ne or $gt. This lets the attacker select and enumerate other users' public profile records.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Openwhyd before 1.65.1 contains a NoSQL injection vulnerability that allows unauthenticated attackers to manipulate user lookups by passing JSON objects in the id parameter. Attackers can send MongoDB query operators such as $ne or $gt to POST /api/user to select and enumerate other users' public profile records.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00403 34th percentileScored 2026-11-07
Fix Fixed openwhyd (openwhyd): 1.65.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openwhydopenwhydbefore 1.65.11.65.1Patch availableCNA
  • openwhyd Vendoropenwhyd Affected before 1.65.1 Fixed in 1.65.1 Patch available CNA

Remediation

Upgrade Openwhyd to version 1.65.1 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA openwhyd (openwhyd) Fixed in 1.65.1

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-123617
  2. 2026-11-06 Alias added: GHSA-224m-3wgx-rg59
  3. 2026-11-06 CISA SSVC decision points changed
  4. 2026-11-06 Priority changed: MEDIUM → HIGH

References

Patch 1

Advisory 1

Other 2

  • TI-2021-02760 Open Redirect in openwhyd/openwhyd CVSS 3.1MEDIUM 6.1
  • TI-2021-02768 Improper Authorization in openwhyd/openwhyd CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences