Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-82411— Objects API: Cross-object-type authorization bypass on the object history-detail endpoint

Quick assessment

Affected
maykinmedia open-object
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Open Object 提供用于管理对象及对象类型的 API 和管理界面。在 2.4.3 至 2.5.1、3.6.2、4.0.2 和 4.1.1 版本中，一个仅被授权读取某一 ObjectType（对象类型）的 Token，却可以通过 history-detail 端点 读取任意其他 ObjectType 的对象的完整版本化记录。 该问题源于 中的 动作：它直接调用了 和 ，而非应调用的 。因此， 以及 中的逐对象权限检查未被执行。此外，查询集（queryset）的 仅适用于列表和搜索动作，而 允许非创建类操作，导

CVSS 6.5 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-82411

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Objects API: Cross-object-type authorization bypass on the object history-detail endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned record of an object of any other ObjectType via the history-detail endpoint `GET /api/v2/objects/{uuid}/{index}`. The `history_detail` action in `src/objects/api/v2/views.py` calls `self.get_queryset()` and `get_object_or_404` directly instead of `self.get_object()`, so `check_object_permissions` and the per-object check in `ObjectTypeBasedPermission.has_object_permission` are not invoked. The queryset's `filter_for_token` applies only to the list and search actions, while `ObjectTypeBasedPermission.has_permission` allows non-create actions, leaving neither check to constrain history-detail records to the token's permitted ObjectType. The normal retrieve endpoint returns 403 for the same unauthorized object, and the sibling history action enforces the grant. Any valid non-superuser API token with a read grant on at least one ObjectType can therefore disclose another ObjectType's complete versioned object `data`, which can include citizen or case records and sensitive identifiers in government deployments. This issue is fixed in versions 2.5.1, 3.6.2, 4.0.2, and 4.1.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
maykinmedia open-object >= 2.4.3, < 2.5.1 -

II. Public POCs for CVE-2026-82411

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-82411

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-82411 (5)

Vendor Advisories for CVE-2026-82411 (1)

Vendor Pages for CVE-2026-82411 (3)

IV. Related Vulnerabilities

Same weakness: CWE-639