What’s Vulnerable › Vulnerabilities

CVE-2026-1213: Askbot 0.12.2 - Insecure Direct Object Reference (IDOR)

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-27 · updated 2026-06-17
• Weakness: CWE-639

Description

All versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile picture of other application users.This issue affects askbot: 0.12.2.

Affected products

• askbot: through 0.12.2

References

• https://askbot.com/
• https://fluidattacks.com/advisories/ghost
• https://github.com/ASKBOT/askbot-devel/commit/3da3d75f35204aa71633c7a315327ba39cb6295d

Get alerted when CVE-2026-1213 or the next vulnerability affects your stack