Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54050— Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image

Quick assessment

Affected
sakaiproject sakai
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Sakai 是一个协作与学习环境（CLE）。从 23.0 到 23.5 以及 25.3 版本中， 端点允许已认证用户删除其他用户的个人资料图片，原因是 方法将攻击者可控的 直接传递给 ，而未验证归属权，随后 会删除对应的记录。相关的 端点同样存在类似缺陷：在调用 删除目标用户的语音录制前，既未进行会话验证，也未检查归属权。上传路径不受影响，因为该路径已经包含归属权验证；超级用户被有意授权可修改他人资料。成功利用该漏洞可反复删除个人资料的身份标识内容（包括管理员和讲师的图片），并扰乱依赖这些身份标识的工作流程。此问题

CVSS 6.5 · Medium EPSS 0.04% · P14

Possible ATT&CK Techniques 1 AI

T1078 · Valid Accounts
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54050

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image
Source: CVE Program / CVE List V5
Vulnerability Description
Sakai is a Collaboration and Learning Environment (CLE). From 23.0 until 23.5 and 25.3, the DELETE /api/users/{userId}/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage() passes the attacker-controlled userId to ProfileServiceImpl.removeProfileImage() without verifying ownership, and profileImageUploadedRepository.deleteById(userId) removes the selected row. The related DELETE /api/users/{userId}/profile/pronunciation endpoint also omits session validation and ownership checks before ProfileServiceImpl.removePronunciationRecording() deletes the target user's recording. The upload path is not affected because it already verifies ownership, and superusers remain intentionally authorized to modify other profiles. Successful exploitation can repeatedly remove profile identity artifacts, including administrator and instructor images, and disrupt workflows that rely on those artifacts. This issue is fixed in versions 23.5, 25.3, and 26.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
sakaiproject sakai >= 23.0, < 23.5 -

II. Public POCs for CVE-2026-54050

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54050

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54050 (1)

Vendor Advisories for CVE-2026-54050 (1)

IV. Related Vulnerabilities

Same product: sakai
Same vendor: sakaiproject
Same weakness: CWE-639

V. Comments for CVE-2026-54050

No comments yet

Leave a comment