What’s Vulnerable › Vulnerabilities

CVE-2026-66091: Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-29 · updated 2026-10-29
• Weakness: CWE-639

Description

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first name, last name and email address) within the same institution.

Affected products

• Apereo Foundation openEQUELLA: from 2019.2 before 2026.1 — fixed in 2026.1

How to fix

Upgrade to a fixed version: Apereo Foundation openEQUELLA 2026.1. Check the vendor advisory for mitigations.

References

• https://github.com/openequella/openEQUELLA/security/advisories/GHSA-mxj9-pmpw-j4xw
• https://openequella.github.io/guides/

Get alerted when CVE-2026-66091 or the next vulnerability affects your stack