MEDIUM 6.5 GitHub
CVE-2026-54050
Sakai Profile Image Deletion has an IDOR
### Summary
The Sakai REST API endpoint `DELETE /api/users/{userId}/profile/image` does not verify that the requesting user is authorized to modify the target user's profile. Any authenticated user can delete the profile image of any other user, including administrators, by supplying a different `userId` in the path. The service layer has no authorization check, and the delete cascades through Content Hosting Service (CHS) with a security advisor that bypasses all CHS permission checks.
### De
Affected Products
- maven/org.sakaiproject.profile2:profile2-api >= 23.0, < 23.5
- maven/org.sakaiproject.profile2:profile2-api >= 25.0, <= 25.2
- maven/org.sakaiproject.profile2:profile2-impl >= 23.0, < 23.5
- maven/org.sakaiproject.profile2:profile2-impl >= 25.0, <= 25.2
References
- https://github.com/advisories/GHSA-9284-fjc3-fmmj
- https://github.com/sakaiproject/sakai/security/advisories/GHSA-9284-fjc3-fmmj
- https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852
- https://github.com/sakaiproject/sakai/releases/tag/23.5
This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-08-24 via GitHub. Affected: maven/org.sakaiproject.profile2:profile2-api >= 23.0, < 23.5, maven/org.sakaiproject.profile2:profile2-api >= 25.0, <= 25.2, maven/org.sakaiproject.profile2:profile2-impl >= 23.0, < 23.5 and 1 more.
vulnfeed aggregates 11313 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.